CVE Feed

    Dashboard / CVE / CVE-2022-21145

    CVE-2022-21145

    A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability.

    Published:Apr 14, 2022
    Last Modified:Apr 15, 2025
    EPS:Apr 14, 2022
    EPSS Score:0.06609
    CVSS Score:4.8

    Affected Products

    Vendor
    Lansweeper
    Product
    Lansweeper

    Exploits

    https://talosintelligence.com/vulnerability_reports/TALOS-2022-1442https://talosintelligence.com/vulnerability_reports/TALOS-2022-1442

    Related CVEs

    CVE-2022-32763 (CVSS 6.1) — A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lan…
    CVE-2022-32573 (CVSS 9.9) — A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lanswee…
    CVE-2022-29517 (CVSS 9.9) — A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweepe…
    CVE-2022-29511 (CVSS 6.5) — A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality o…
    CVE-2022-28703 (CVSS 5.4) — A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionalit…
    CVE-2022-27498 (CVSS 6.5) — A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionali…
    CVE-2022-22149 (CVSS 8.8) — A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9…
    CVE-2022-21234 (CVSS 8.8) — An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. …
    CVE-2022-21210 (CVSS 8.8) — An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2…
    CVE-2020-13658 (CVSS 8) — In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweep…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High