CVE-2022-35739

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrary Cascading Style Sheets (CSS) data is inserted into the style tag, loading malicious content. Due to PRTG Network Monitor preventing “characters, and from modern browsers disabling JavaScript support in style tags, this vulnerability could not be escalated into a Cross-Site Scripting vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-35749.8The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injeCVE-2022-357406.1dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URLCVE-2022-357419.8Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML exterCVE-2022-357427.5Microsoft Outlook Denial of Service VulnerabilityCVE-2022-357437.8Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityCVE-2022-357449.8Windows Point-to-Point Protocol (PPP) Remote Code Execution VulnerabilityCVE-2022-357458.1Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityCVE-2022-357467.8Windows Digital Media Receiver Elevation of Privilege VulnerabilityCVE-2022-357475.9Windows Point-to-Point Protocol (PPP) Denial of Service VulnerabilityCVE-2022-357487.5HTTP.sys Denial of Service VulnerabilityCVE-2022-357497.8Windows Digital Media Receiver Elevation of Privilege VulnerabilityCVE-2022-35759.8Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication
CVE-2022-35739: Medium severity, CVSS 5.3 | Vulnix