CVE-2022-42992

MediumCVSS 5.4

Published: 27/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

Multiple stored cross-site scripting (XSS) vulnerabilities were found in Train Scheduler App v1.0. Attackers can inject malicious JavaScript or HTML into the Train Code, Train Name, and Destination text fields.

Risk Assessment

The risk involves arbitrary script execution in users' browsers, potentially leading to session theft, account takeover, or malware distribution within the organization.

Recommendation

Immediately update the application to the latest version or apply a patch fixing the XSS vulnerabilities. Additionally, implement input validation, sanitization, and HTML output encoding.

Original NVD description (English source)

Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields.