CVE-2022-31299

Deeper analysis

Haraj version 3.7 contains a reflected cross-site scripting vulnerability, tracked as CVE-2022-31299, that resides in the User Upgrade Form and is classified under CWE-79. The flaw carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, and required user interaction, with limited impacts on confidentiality and integrity under changed scope.

An unauthenticated remote attacker can exploit the issue by supplying a crafted URL that triggers execution of arbitrary script in the context of a victim user who clicks the link, enabling actions such as session token theft or unauthorized actions within the affected application.

Public references point to the vendor site and a proof-of-concept repository, yet no specific mitigation guidance, patch details, or advisory statements are supplied in the available sources. The associated EPSS score rose from a low baseline to a peak of 0.4971 before settling at the current value of 0.3399, indicating measurable post-disclosure interest in exploitation.