CVE-2022-44951

MediumCVSS 5.4

Published: 02/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.94%

57th percentile - higher than 57% of all known CVEs

Summary

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. Attackers can inject malicious JavaScript or HTML into the Name field, leading to arbitrary script execution in victims' browsers.

Risk Assessment

The risk includes session hijacking, admin account takeover, or malware distribution within the organization due to arbitrary script execution in victims' browsers.

Recommendation

Immediately update Rukovoditel to the latest version and implement input filtering and validation for the Name field to prevent injection of HTML and JavaScript tags.

Original NVD description (English source)

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.