CVE Catalog
CVE-2022-42991
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk0.45%
36th percentile - higher than 36% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.
Risk Assessment
The risk involves arbitrary script execution in users' browsers, potentially leading to session hijacking, malicious redirects, or data theft.
Recommendation
Update the system to the latest version or implement proper input filtering and encoding for the Full Name field.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.