CVE-2022-39035

Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack.

Score

CVSS 3.1 6.1 Medium

Status

Modified - twcert@cert.org.tw

Published

2022-09-28

Last modified

2025-05-21

Weaknesses

CWE-79

Affected products

• Smart Evision (Lcnet)
• Smart Evision (Smart Evision Information Technology Inc.)

References

• https://www.twcert.org.tw/tw/cp-132-6572-5c2c8-1.html