CVE-2022-40029
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php component. Attackers can inject arbitrary web scripts or HTML via the shortName parameter.
Risk Assessment
The risk involves executing arbitrary scripts in the victim's browser, potentially leading to session theft, account takeover, or displaying fraudulent content.
Recommendation
Update the system to the latest version or implement input filtering and validation for the shortName parameter in newProjectValidation.php.
Other vulnerabilities in Simple Task Managing System
See all- CVE-2022-40030Critical
SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at changeStatus.php. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2022-40028Medium
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 in the newProjectValidation.php file. Attackers can inject arbitrary web scripts or HTML via the fullName parameter.
- CVE-2022-40027Medium
A cross-site scripting (XSS) vulnerability was discovered in SourceCodester Simple Task Managing System v1.0 via the newTask.php component. Attackers can inject arbitrary web scripts or HTML through the shortName parameter.
Original NVD description (English source)
SourceCodester Simple Task Managing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component newProjectValidation.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shortName parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS