CVE-2022-39240 MEDIUM

CVE-2022-39240: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in MyGraph

Vendor Renlm

Product MyGraph

Weakness CWE-79 · XSS

Published September 24, 2022

Last update April 25, 2025

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.

Key dates

02Disclosure timeline

September 24, 2022 CVE published

April 25, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-39240 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2026-23525 1panel App Store vulnerable to Cross-site Scripting CVE-2025-10434 IbuyuCMS Add Article article.php cross site scripting CVE-2025-26558 WordPress Aparat Responsive plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability CVE-2023-47549 WordPress EazyDocs Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS) CVE-2025-23975 WordPress Botnet Attack Blocker plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability