CVE-2022-35118
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
PyroCMS version 3.9 was found to contain multiple cross-site scripting (XSS) vulnerabilities.
Risk Assessment
An attacker can inject malicious JavaScript code, potentially leading to session theft, account takeover, or website defacement.
Recommendation
It is recommended to immediately update PyroCMS to the latest available version and implement input and output sanitization for user data.
Other vulnerabilities in PyroCMS
See all- CVE-2022-37721Critical
PyroCMS 3.9 is vulnerable to a stored XSS attack, allowing a low-privileged user (e.g., author) to inject malicious HTML and JavaScript into blog post content. This can lead to full admin account takeover or privilege escalation.
- CVE-2024-58297Medium
PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. A payload in the 'Redirect From' field executes arbitrary JavaScript when administrators view the redirects page.
Original NVD description (English source)
PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS