CVE-2022-40778

5.4 mediumEPSS 0.5%

Medium (5.4) in opswat metadefender. EPSS 0.5% chance of exploitation in the next 30 days.

A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-09-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

opswat:metadefender

References

https://docs.opswat.com/mdicap/release-notes
https://www.opswat.com/products/metadefender/icap
https://docs.opswat.com/mdicap/release-notes
https://www.opswat.com/products/metadefender/icap

Check your stack JSON