CVE-2022-46903

Published: Dec 12, 2022Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Stored XSS.

Affected (1)

Products: Websoft: Websoft Hcm

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Websoft Websoft Hcm	Version 2021.2.3.327

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://news.websoft.ru/_wt/wiki_base/7175851369410989446

Source: cve@mitre.org

Vendor Advisory

https://news.websoft.ru/_wt/wiki_base/7175851369410989446

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.