CVE-2022-40965

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Delta Electronics	DIAEnergie	>= All, < v1.9.01.002

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06Mitigation, Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-06Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Oct 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-409668.8Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and acce CVE-2022-409678.8The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A lo CVE-2022-409686.1Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress.CVE-2022-409698.8An os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A special CVE-2022-40975.3The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security feat CVE-2022-409717.8Incorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to CVE-2022-409727.8Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable CVE-2022-409745.5Incomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to potentially enable informa CVE-2022-409755.4Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7.CVE-2022-409765.5A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious con CVE-2022-409777.5A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, m CVE-2022-409787.8The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking