CVE-2022-37720

CriticalCVSS 9.0/10Last modified Jul 9, 2026

Description

Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://labs.integrity.pt/advisories/cve-2022-37720/Exploit, Third Party Advisory
https://labs.integrity.pt/advisories/cve-2022-37720/Exploit, Third Party Advisory

Timeline

Published: Nov 25, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-377219.0PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and ja CVE-2022-377246.1Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all CVE-2022-377308.8In ftcms 2.1, there is a Cross Site Request Forgery (CSRF) vulnerability in the PHP page, which causes the attacker to forge a link to trick CVE-2022-377316.1ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker inserts malicious JavaScript code into the web page, causing the user / administr CVE-2022-377347.5graphql-java before19.0 is vulnerable to Denial of Service. An attacker can send a malicious GraphQL query that consumes CPU resources. The CVE-2022-37749.1A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown funct CVE-2022-37757.1When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained CVE-2022-37768.8The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions CVE-2022-377679.8Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the ve CVE-2022-377687.5libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.CVE-2022-377696.5libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecoder.hpp. This vulnerability allo CVE-2022-377706.5libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at linemerger.cpp. This vulnerabili