CVE-2022-37162

5.4 mediumEPSS 0.8%

Medium (5.4) in claroline claroline. EPSS 0.8% chance of exploitation in the next 30 days.

Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-08-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

claroline:claroline

References

https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/calendar_xss/calendar_xss.md
https://github.com/matthieu-hackwitharts/claroline-CVEs/blob/main/calendar_xss/calendar_xss.md

Check your stack JSON