CVE-2022-4602

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/api/theme-edit/ of the component Review Flow Handler. The manipulation of the argument Title leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-216197 was assigned to this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-707 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-460209.8WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.CVE-2022-460217.5X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.CVE-2022-460259.1Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi syst CVE-2022-46036.5A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the compo CVE-2022-46048.8A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the functio CVE-2022-460474.9AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.CVE-2022-46055.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-460517.2The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.CVE-2022-460584.8AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to CVE-2022-460596.5AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-46069.8PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-460616.1AeroCMS v0.0.1 is vulnerable to ClickJacking.