CVE-2022-43695

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-436966.1OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.CVE-2022-436976.1OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.CVE-2022-436984.3OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.CVE-2022-436994.3OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversCVE-2022-43707.2The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, lCVE-2022-437017.8When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation diCVE-2022-437027.8When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) theCVE-2022-437037.8An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacCVE-2022-437045.9The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate usCVE-2022-437059.1In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1CVE-2022-437065.4Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to paCVE-2022-437076.1MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via
CVE-2022-43695: Medium severity, CVSS 4.8 | Vulnix