CVE-2022-4089

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/processlogin.php. The manipulation of the argument user leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214324.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-707 CWE-79

Affected software

Vendor	Product	Versions
rickxy	Stock Management System	n/a

References

https://github.com/rickxy/Stock-Management-System/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?id.214324Third Party Advisory
https://github.com/rickxy/Stock-Management-System/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?id.214324Third Party Advisory

Timeline

Published: Nov 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-408907.5A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.CVE-2022-408959.1In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to a CVE-2022-408965.5A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.CVE-2022-408975.9Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted packag CVE-2022-408987.5An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via a CVE-2022-408997.5An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie CVE-2022-40908.8A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the CVE-2022-409036.5Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows CVE-2022-40916.1A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function quer CVE-2022-409126.1ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting (XSS). Input passed to the GET parameter 'CVE-2022-409169.8Tiny File Manager v2.4.7 and below is vulnerable to session fixation.CVE-2022-409189.8Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote cod