CVE-2022-4554

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerability. This has been fixed in the version 1.0.0.347.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ID Software Project and Consultancy Services	B2B Customer Ordering System	>= 1.0.0.347, < 0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0022
https://www.usom.gov.tr/bildirim/tr-23-0022Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-23-0022Third Party Advisory

Timeline

Published: Jan 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-455406.1EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-CVE-2022-455416.1EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-CVE-2022-455425.4EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file.CVE-2022-455436.1Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or usernam CVE-2022-455448.8Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code CVE-2022-455467.5Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credenti CVE-2022-455488.8AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability.CVE-2022-45555.3The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hook CVE-2022-455509.8AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).CVE-2022-455519.8An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command t CVE-2022-455527.5An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive inf CVE-2022-455539.8An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial