CVE-2022-34611

MediumCVSS 5.4

Published: 27/07/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was found in Online Fire Reporting System v1.0 in /index.php/?p=report. Attackers can inject malicious JavaScript or HTML via the "Contac #" text field.

Risk Assessment

The risk involves arbitrary script execution in the victim's browser, potentially leading to session theft, malicious redirects, or sensitive data exfiltration.

Recommendation

Update the system to the latest version or implement input filtering (validation and sanitization) for the "Contac #" field and use Content-Security-Policy headers.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "Contac #" text field.