CVE-2022-40434

CriticalCVSS 9.8

Published: 19/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.09%

61th percentile - higher than 61% of all known CVEs

Summary

Softr v2.0 was found vulnerable to HTML injection via the Name field on the Account page. An attacker can inject malicious HTML code that will be executed in the victim's browser.

Risk Assessment

The risk includes potential phishing attacks, defacement, or session theft through injected HTML code.

Recommendation

It is recommended to update Softr to the latest version and implement input validation and encoding for the Name field.

Original NVD description (English source)

Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.