CVE-2022-43711

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) because the CSP header uses eval() in the script-src.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-437126.5POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an CVE-2022-437137.5Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form valid CVE-2022-437167.5A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-CVE-2022-437175.4Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be per CVE-2022-437185.4Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users wit CVE-2022-437198.8Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Supers CVE-2022-43727.2The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading CVE-2022-437205.4An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped CVE-2022-437215.4An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to thi CVE-2022-437227.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing l CVE-2022-437237.5A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software d CVE-2022-437249.8A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inb