CVE-2022-37137

PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket

Medium · published September 14, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the view ticket function.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00598 · 48.0th percentile
Published
2022-09-14T03:24Z
EPSS history
Timeline
  • 14 SEP 03:24Z
    PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket
    cvelistv5