CVE-2022-40739 MEDIUM

CVE-2022-40739: Ragic, Inc. Ragic - Reflected XSS

Vendor Ragic, Inc.
Product Ragic
Weakness CWE-79 · XSS
Published October 31, 2022
Last update May 6, 2025
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user privilege can inject JavaScript to perform XSS (Reflected Cross-Site Scripting) attack.

Key dates

02Disclosure timeline

October 31, 2022 CVE published
May 6, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-0200 Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting CVE-2026-23604 GFI MailEssentials AI < 22.4 Keyword Filtering Rule Stored XSS CVE-2023-6442 PHPGurukul Nipah Virus Testing Management System add-phlebotomist.php cross site scripting CVE-2026-28083 WordPress Flatsome theme <= 3.20.5 - Cross Site Scripting (XSS) vulnerability CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter