CVE-2022-39020

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student assessment submission, file upload, news, ePortfolio and calendar event creation were found to be vulnerable to cross-site scripting.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390216.1U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vulnerability to redir CVE-2022-390226.5U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab CVE-2022-390236.5U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab CVE-2022-390246.1U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vuln CVE-2022-390256.1U-Office Force PrintMessage function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this CVE-2022-390265.4U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote attacker with general CVE-2022-390275.4U-Office Force Forum function has insufficient filtering for special characters. A remote attacker with general user privilege can inject Ja CVE-2022-390287.5telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff CVE-2022-390296.5Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explic CVE-2022-39034.6An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches CVE-2022-390307.5smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly CVE-2022-390315.3Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability t