CVE-2022-46058

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-460596.5AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-46069.8PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-460616.1AeroCMS v0.0.1 is vulnerable to ClickJacking.CVE-2022-460624.5Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-46079.8A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some CVE-2022-460707.5GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.CVE-2022-460719.8There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.CVE-2022-460729.8Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection.CVE-2022-460736.1Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).CVE-2022-460748.8Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missin CVE-2022-460767.5D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi.CVE-2022-46087.5A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only