CVE-2022-33009

MediumCVSS 4.8

Published: 27/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile - higher than 38% of all known CVEs

Summary

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.

Risk Assessment

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or exfiltrate sensitive data, compromising the entire CMS system.

Recommendation

Immediately update LightCMS to the latest patched version and implement file type validation and input sanitization.

Original NVD description (English source)

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.