CVE-2022-1290CWE-79

Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk

Critical · published April 10, 2022

CVSS v3.0
9.0
EPSS
2%
Percentile
76.4
In the wild
Unconfirmed
What it is

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse.

The record
Technical detail
CVSS v3.0
9.0 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01653 · 76.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-04-10T15:50Z
EPSS history
Timeline
  • 10 APR 15:50Z
    Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk
    cvelistv5