CVE-2022-3497

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been classified as problematic. Affected is an unknown function of the component Master List. The manipulation of the argument city/state/country/position leads to cross site scripting. It is possible to launch the attack remotely. VDB-210786 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-707 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-349709.8Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerabilit CVE-2022-349718.8An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code v CVE-2022-349729.8So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_CVE-2022-349737.5D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.CVE-2022-349749.8D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.CVE-2022-349819.8The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.CVE-2022-349829.8The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.CVE-2022-349839.8The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.CVE-2022-349885.4Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js.CVE-2022-349899.8Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php.CVE-2022-34996.5An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthor CVE-2022-349915.4Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name param