CVE-2022-4347

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file WebUtils.java. The manipulation of the argument user leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215107.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-707

Affected software

Vendor	Product	Versions
xiandafu	beetl-bbs	n/a

References

https://gitee.com/xiandafu/beetl-bbs/issues/I5XD5OExploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?id.215107Third Party Advisory
https://gitee.com/xiandafu/beetl-bbs/issues/I5XD5OExploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?id.215107Third Party Advisory

Timeline

Published: Dec 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-434707.3Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and ea CVE-2022-434724.3Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Contro CVE-2022-434735.4A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially c CVE-2022-434747.8Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticate CVE-2022-434757.8Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially ena CVE-2022-434764.3Missing Authorization vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows Exploiting Incorrectly Configur CVE-2022-434775.5Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local acc CVE-2022-434796.1Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web s CVE-2022-43486.1A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2022-434804.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.CVE-2022-434814.3Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dis CVE-2022-434828.8Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.