CVE-2022-41128

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Aug 10, 2026

Description

Windows Scripting Languages Remote Code Execution Vulnerability

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Nov 9, 2022
Last modified
Aug 10, 2026
Added to CISA KEV
Nov 8, 2022
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-411317.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, ApCVE-2022-411326.1Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress.CVE-2022-411338.8The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingCVE-2022-411348.8Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versioCVE-2022-411355.3Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress.CVE-2022-411368.8Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugiCVE-2022-411378.3Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions tCVE-2022-411389.8In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.CVE-2022-411395.4MITRE CALDERA 4.1.0 allows stored XSS via app.contact.gist (aka the gist contact configuration field), leading to execution of arbitrary comCVE-2022-41145.4The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perfCVE-2022-411408.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. AuthentCVE-2022-411417.8This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the