CVE-2022-36277 MEDIUM

CVE-2022-36277: SQL injection vulnerability in TCMAN GIM

Vendor Tcman

Product GIM

Weakness CWE-79 · XSS

Published October 4, 2023

Last update September 5, 2024

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

The 'sReferencia', 'sDescripcion', 'txtCodigo' and 'txtDescripcion' parameters, in the frmGestionStock.aspx and frmEditServicio.aspx files in TCMAN GIM v8.0.1, could allow an attacker to perform persistent XSS attacks.

Key dates

02Disclosure timeline

October 4, 2023 CVE published

September 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-36277 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-67542 WordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability CVE-2022-42346 AEM Reflected XSS Arbitrary code execution CVE-2023-1701 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore CVE-2022-41643 WordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability CVE-2023-48463 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)