CVE-2022-39035

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Smart eVision Information Technology Inc.	Smart eVision	2022.02.21

References

https://www.twcert.org.tw/tw/cp-132-6572-5c2c8-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-6572-5c2c8-1.htmlThird Party Advisory

Timeline

Published: Sep 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390369.8The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can CVE-2022-390377.5Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability t CVE-2022-390388.8Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name of CVE-2022-390399.8aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to se CVE-2022-39046.1The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauth CVE-2022-390407.5aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to byp CVE-2022-390419.8aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnera CVE-2022-390429.8aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authen CVE-2022-390432.4Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can acces CVE-2022-390446.8Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege t CVE-2022-390458.8A file write vulnerability exists in the httpd upload.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted H CVE-2022-390465.3An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes,