CVE-2022-36530

MediumCVSS 6.1

Published: 16/08/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.69%

48th percentile - higher than 48% of all known CVEs

Summary

An XSS (Cross-Site Scripting) vulnerability was discovered in rageframe2 version 2.6.37. The flaw exists in user agent related parameters on the info.php page.

Risk Assessment

An attacker can inject malicious JavaScript code that executes in the victim's browser, potentially leading to session theft, redirects, or data theft.

Recommendation

Update rageframe2 to the latest available version that includes a fix for this vulnerability. If an update is not possible, thoroughly filter and encode user-supplied input, especially in user agent parameters.

Original NVD description (English source)

An issue was discovered in rageframe2 2.6.37. There is a XSS vulnerability in the user agent related parameters of the info.php page.