CVE-2022-2036

MEDIUM5.4EPSS 0.38%

Cross site scripting in francoisjacquet/rosariosis

Published: 6/10/2022Modified: 11/8/2023

Description

A Cross-site Scripting (XSS) vulnerability exists in in GitHub repository francoisjacquet/rosariosis prior to 9.1. HTML entities are not properly decoded from the URL.

Affected packages (1)

Packagist/francoisjacquet/rosariosisfrom 0, < 9.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-2036
PATCHhttps://github.com/francoisjacquet/rosariosis
WEBhttps://github.com/francoisjacquet/rosariosis/commit/6e213b17e6ac3a3961e1eabcdaba1c892844398a
WEBhttps://huntr.dev/bounties/c7715149-f99c-4d62-a5c6-c78bfdb41905