CVE-2022-38357

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/module_frame/index.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	Eyes of Network Web	5.3

References

https://www.tenable.com/security/research/tra-2022-29Exploit, Third Party Advisory
https://www.tenable.com/security/research/tra-2022-29Exploit, Third Party Advisory

Timeline

Published: Aug 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-383586.1Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting at CVE-2022-383598.8Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections CVE-2022-38364.8The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2022-383628.8Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of co CVE-2022-383675.3The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user CVE-2022-383688.8An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authenticatio CVE-2022-383698.8Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.CVE-2022-38374.8The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2022-383707.5Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of databa CVE-2022-383717.5A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (CVE-2022-383726.7A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow a CVE-2022-383735.4An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 thr