CVE-2022-40004

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-400058.8Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 CVE-2022-400089.8SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.CVE-2022-400099.8SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.CVE-2022-40017.3An authentication bypass vulnerability could allow an attacker to access API functions without authentication.CVE-2022-400105.4Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the CVE-2022-400116.1Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then usCVE-2022-400167.5Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in librtmp, allows attackeCVE-2022-40027.2A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted APICVE-2022-400219.8QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.CVE-2022-400229.8Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.CVE-2022-400237.5Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects baCVE-2022-400267.2SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at board.ph
CVE-2022-40004: Critical severity, CVSS 9.6 | Vulnix