CVE-2022-29005

Deeper analysis

CVE-2022-29005 is a set of reflected cross-site scripting flaws (CWE-79) located in the /obcs/user/profile.php component of Online Birth Certificate System version 1.2. Untrusted input supplied through the fname and lname parameters is rendered without sanitization or output encoding, allowing an attacker to supply HTML or JavaScript payloads that execute in the browser of any user who subsequently views the affected profile page. The vulnerability received a CVSS 3.1 score of 6.1.

An unauthenticated remote attacker can craft a malicious link or form submission that injects the payload; when a victim follows the link or loads the profile, the script runs in the victim's context with the changed scope noted in the CVSS vector. Successful exploitation can result in theft of session tokens, display of arbitrary content, or limited actions on behalf of the victim within the application.

The associated EPSS score started low after disclosure but rose materially to a peak of 0.2212 on 2025-12-11 before receding to its current value of 0.0737, indicating a measurable increase in observed exploitation interest well after the initial publication date. No vendor-supplied patches or official mitigation guidance appear among the listed references.