CVE-2022-43363

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.telegram.org/c/17831Product
https://pastebin.com/72MRwNXWExploit, Third Party Advisory
https://bugs.telegram.org/c/17831Product
https://pastebin.com/72MRwNXWExploit, Third Party Advisory

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-433647.5An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change th CVE-2022-433657.5IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. This vulnerability allows attacker CVE-2022-433667.5IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, CVE-2022-433679.8IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.CVE-2022-433696.1AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php.CVE-2022-43379.8An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-433724.8Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php.CVE-2022-433766.1A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code an CVE-2022-433777.5A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute for CVE-2022-433786.5A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performin CVE-2022-43389.8An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.CVE-2022-433806.2IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to ca