CVE-2022-23049

5.4 mediumEPSS 3.0%

Medium (5.4) in exponentcms exponent cms. EPSS 3.0% chance of exploitation in the next 30 days.

Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-02-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

exponentcms:exponent_cms

References

https://exponentcms.lighthouseapp.com/projects/61783/tickets/1461
https://fluidattacks.com/advisories/cobain/
https://github.com/exponentcms/exponent-cms/issues/1546
https://exponentcms.lighthouseapp.com/projects/61783/tickets/1461
https://fluidattacks.com/advisories/cobain/

Check your stack JSON