CVE-2022-26644
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
Risk Assessment
An attacker can exploit these vulnerabilities to inject malicious JavaScript code, potentially leading to session hijacking, account takeover, or theft of sensitive financial data.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement input validation and sanitization, and use Content Security Policy (CSP) headers.
Other vulnerabilities in Online Banking System Protect
See all- CVE-2022-26646Critical
Online Banking System Protect v1.0 contains a local file inclusion (LFI) vulnerability via the pages parameter. This allows an attacker to read sensitive files on the server.
- CVE-2022-26645Critical
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
Original NVD description (English source)
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS