CVE-2022-40739

Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user privilege can inject JavaScript to perform XSS (Reflected Cross-Site Scripting) attack.

Score

CVSS 3.1 5.4 Medium

Status

Modified - twcert@cert.org.tw

Published

2022-10-31

Last modified

2025-05-06

Weaknesses

CWE-79

Affected products

• Ragic (Ragic)
• Ragic (Ragic Inc.)

References

• https://www.twcert.org.tw/tw/cp-132-6645-77bf8-1.html