CVE-2022-41676

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Raiden MAILD Mail Server website mail field has insufficient filtering for user input. A remote attacker with general user privilege can send email using the website with malicious JavaScript in the input field, which triggers XSS (Reflected Cross-Site Scripting) attack to the mail recipient.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-85CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 29, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-416775.3An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve informatiCVE-2022-416788.8Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetCVE-2022-416796.1Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote attacker to inject javaCVE-2022-416806.5Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could alloCVE-2022-416818.8There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the role of student) to priCVE-2022-416845.5A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSDCVE-2022-416858.8Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and CVE-2022-416864.4OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have an Out-of-bound memory read and write vulnerability in /dev/mmz_userdevCVE-2022-416877.8Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.4CVE-2022-416887.5Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify userCVE-2022-416897.8Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated user to potentially enCVE-2022-41695.3The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing