CVE-2022-39301

MEDIUM Year: 2022
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-80
View all →

Vulnerability Description

sra-admin is a background rights management system that separates the front and back end. sra-admin version 1.1.1 has a storage cross-site scripting (XSS) vulnerability. After logging into the sra-admin background, an attacker can upload an html page containing xss attack code in "Personal Center" - "Profile Picture Upload" allowing theft of the user's personal information. This issue has been patched in 1.1.2. There are no known workarounds.

Related Vulnerabilities

CVE-2017-20034

MEDIUM
CVSS:5.4(Medium)

A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site...

CWE-802017

CVE-2017-20035

MEDIUM
CVSS:5.4(Medium)

A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation...

CWE-802017

CVE-2017-20036

MEDIUM
CVSS:5.4(Medium)

A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bounce Rule. The manipulation leads to cros...

CWE-802017

CVE-2017-20043

MEDIUM
CVSS:5.4(Medium)

A vulnerability was found in Navetti PricePoint 4.6.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting (Persi...

CWE-802017

CVE-2017-20044

MEDIUM
CVSS:5.4(Medium)

A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown part. The manipulation leads to basic cross site scripting (Reflected). It is po...

CWE-802017

CVE-2017-20054

MEDIUM
CVSS:5.4(Medium)

A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site ...

CWE-802017