CVE-2022-28985

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML…

Medium · published May 20, 2022

CVSS v3.1
6.3
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:H/PR:L/S:U/UI:R
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Published
2022-05-20T01:43Z
EPSS history
Timeline
  • 20 MAY 01:43Z
    A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML…
    cvelistv5