CVE-2022-44946

MediumCVSS 5.4

Published: 02/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.05%

60th percentile - higher than 60% of all known CVEs

Summary

Rukovoditel v3.2.1 was found to have a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. Attackers can inject arbitrary JavaScript or HTML into the Title field, which will be executed in other users' browsers.

Risk Assessment

The risk includes session hijacking, administrator account takeover, or displaying malicious content, potentially compromising the confidentiality and integrity of data within Rukovoditel.

Recommendation

Immediately update Rukovoditel to the latest version and implement input filtering and validation for the Title field to prevent script injection.

Original NVD description (English source)

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.