CVE-2022-25869

Published Jul 15, 2022

Last updated 10 months ago

CVSS medium 4.2
XSS

Overview

Description
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
Source
report@snyk.io
NVD status
Modified
Products
angularjs

Risk scores

CVSS 3.1

Type
Primary
Base score
6.1
Impact score
2.7
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity
MEDIUM

Weaknesses

report@snyk.io
CWE-79
nvd@nist.gov
CWE-79

Social media

Hype score
Not currently trending

  1. taking my time with fries PWM 2.0.8 known vulnerabilities CVE-2022-25844 &amp; CVE-2025-4690: Regular expression denial of service (ReDoS) flaws. CVE-2022-25869: Cross-site scripting (XSS) vulnerability. CVE-2024-8372 &amp; CVE-2024-8373: Content spoofing and improper input hand

    @0x8A7

    28 Jul 2026

    38 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator browsers when accessed through the image gallery API without content-type validation or CSP headers.•CVE-2026-84695
  2. WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder()/isAVideoMobileApp() checks match HTTP_USER_AGENT against a hardcoded literal ("AVideoEncoder"/"AVideoMobileApp") with no IP check or shared secret. An attacker who submits valid credentials and sets User-Agent: AVideoEncoder bypasses two-factor authentication, skips brute-force captcha escalation, and avoids being recorded in the login/device audit history. No patch is available at the time of publication.•CVE-2026-84479
  3. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.•CVE-2026-74234
  4. WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).•CVE-2026-64638
  5. Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.•CVE-2026-65439

References

Sources include official advisories and independent security research.