CVE-2022-40690

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
BookStack	BookStack	versions prior to v22.09

References

https://jvn.jp/en/jp/JVN78862034/index.htmlRelease Notes, Third Party Advisory
https://www.bookstackapp.com/blog/bookstack-release-v22-09/Release Notes, Vendor Advisory
https://www.bookstackapp.com/docs/admin/security/#using-bookstack-content-externallyVendor Advisory
https://jvn.jp/en/jp/JVN78862034/index.htmlRelease Notes, Third Party Advisory
https://www.bookstackapp.com/blog/bookstack-release-v22-09/Release Notes, Vendor Advisory
https://www.bookstackapp.com/docs/admin/security/#using-bookstack-content-externallyVendor Advisory

Timeline

Published: Oct 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-406915.3An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. CVE-2022-406928.8Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.CVE-2022-406937.5A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A CVE-2022-406944.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress.CVE-2022-406958.8Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress.CVE-2022-406967.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanc CVE-2022-406974.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions.CVE-2022-406986.1Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.CVE-2022-406996.1Cross-Site Scripting (XSS) vulnerability in Dario Curvino Yasr – Yet Another Stars Rating plugin <= 3.1.2 versions.CVE-2022-40709.8Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.CVE-2022-407009.8Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership CVE-2022-407018.1A directory traversal vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially