Vulnerability Database

299,038

Total vulnerabilities in the database

CVE-2022-40487

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.

Published: Oct 31, 2022
Updated: May 9, 2024
CVE: CVE-2022-40487
GHSA: GHSA-8g35-prrr-gxxf
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
processwire / processwire	3.0.200	3.0.200.x
processwire / processwire	-	3.0.200.x

http://processwire.com
https://gist.github.com/filipaze/32ab8683af8d82827028164e361b6e86

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo