CVE-2022-44960

32th percentile - higher than 32% of all known CVEs

A cross-site scripting (XSS) vulnerability was discovered in webtareas 2.4p5 in the component /general/search.php?searchtype=simple. Attackers can inject arbitrary web scripts or HTML via a crafted payload in the Search field.

The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. This can be exploited for phishing attacks or to compromise administrator accounts.

Update webtareas to the latest patched version immediately. If not available, implement input validation and output encoding for the 'search' parameter in search.php.