Paper/Archive/CVE-2022-1330

CVE-2022-1330

alvarotrigo alvarotrigo/fullpage.js — stored xss due to unsantized anchor url in alvarotrigo/fullpage.js

EPSS 0.8%CVSS 9.4

critical.is priorityof 100

40

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 57.4.574 × 2011.5 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .

Affected

ProductAffectedFixed inSource

alvarotrigo/fullpage.jsunspecified – < 4.0.44.0.4CNA

Scores by source

@huntrdev (CNA)9.4CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

References

refhuntr.dev/bounties/08d2a6d0-772f-4b05-834e-86343f263c35 refgithub.com/alvarotrigo/fullpage.js/commit/e7a5db42711700c8a584e61b5e532a64039fe92b