CVE-2022-32174

CVE-2022-32174: Gogs - XSS

Vendor Gogs

Product gogs

Weakness CWE-79 · XSS

Published October 11, 2022

Last update May 16, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

Key dates

02Disclosure timeline

October 11, 2022 CVE published

May 16, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-32174 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-26218 TIBCO Nimbus Reflected Cross-site Scripting (XSS) vulnerabilities CVE-2019-25380 Smoothwall Express 3.1 'dhcp.cgi' Cross-Site Scripting CVE-2025-31615 WordPress Simple Contact Forms plugin <= 1.6.4 - CSRF to Stored XSS vulnerability CVE-2026-8880 RomanCart Ecommerce <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2025-55106 BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.

Identifiers

CVE CVE-2022-32174

CWE CWE-79

Affected versions

Vendor Gogs

Product gogs

Affected ≥ v0.6.5 and < unspecified

Vendor Gogs

Product gogs

Affected ≥ unspecified and ≤ v0.12.10