CVE-2022-32074

MediumCVSS 5.4/10Last modified Jul 10, 2026

Description

A stored cross-site scripting (XSS) vulnerability in the component audit/class.audit.php of osTicket-plugins - Storage-FS before commit a7842d494889fd5533d13deb3c6a7789768795ae allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 13, 2022
Last modified
Jul 10, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-32086.5The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin cCVE-2022-320817.5MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0altCVE-2022-320827.5MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.CVE-2022-320837.5MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker.CVE-2022-320847.5MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.CVE-2022-320857.5MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor.CVE-2022-320867.5MariaDB v10.4 to v10.8 was discovered to contain a segmentation fault via the component Item_field::fix_outer_field.CVE-2022-320877.5MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args.CVE-2022-320887.5MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::reporCVE-2022-320897.5MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.CVE-2022-32096.1The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX aCVE-2022-320917.5MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_in
CVE-2022-32074: Medium severity, CVSS 5.4 | Vulnix