CVE-2022-1514

Description

FacturaScripts prior to version 2022.06 is vulnerable to stored cross-site scripting via upload plugin functionality in zip format.

How to fix CVE-2022-1514

To remediate CVE-2022-1514, upgrade the affected package to a fixed version below.

• Packagist/facturascripts/facturascripts—upgrade to 2022.06 or later

Is CVE-2022-1514 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 2022.06

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-1514
• PATCHgithub.com/NeoRazorX/facturascripts
• WEBgithub.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e
• WEBhuntr.dev/bounties/4ae2a917-843a-4ae4-8197-8425a596761c