First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2022-4865

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
usememos	usememos/memos	>= unspecified, < 0.9.1

References

https://github.com/usememos/memos/commit/7670c9536000bb32c6345d4906a91268dcddd5fcPatch, Third Party Advisory
https://huntr.dev/bounties/cd8765a2-bf28-4019-8647-882ccf63b2beExploit, Third Party Advisory
https://github.com/usememos/memos/commit/7670c9536000bb32c6345d4906a91268dcddd5fcPatch, Third Party Advisory
https://huntr.dev/bounties/cd8765a2-bf28-4019-8647-882ccf63b2beExploit, Third Party Advisory

Timeline

Published: Dec 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-486504.7In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() Commit 8f39 CVE-2022-486517.7In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header If an AF CVE-2022-486525.5In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There CVE-2022-486535.5In the Linux kernel, the following vulnerability has been resolved: ice: Don't double unplug aux on peer initiated reset In the IDC callba CVE-2022-486545.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() nf CVE-2022-486557.8In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing res CVE-2022-486565.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_g CVE-2022-486577.8In the Linux kernel, the following vulnerability has been resolved: arm64: topology: fix possible overflow in amu_fie_setup() cpufreq_get_CVE-2022-486587.8In the Linux kernel, the following vulnerability has been resolved: mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task contex CVE-2022-486595.5In the Linux kernel, the following vulnerability has been resolved: mm/slub: fix to return errno if kmalloc() fails In create_unique_id(),CVE-2022-48669.0Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-486605.5In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully