CVE-2022-34093

Deeper analysis

Portal do Software Publico Brasileiro i3geo version 7.0.5 contains a cross-site scripting vulnerability in the access_token.php component, tracked as CVE-2022-34093 under CWE-79. The flaw received a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated remote attacker can supply a crafted request to access_token.php that executes arbitrary script in the browser of a victim who follows a malicious link or visits a compromised page. Successful exploitation allows theft of session tokens or other client-side data and limited actions within the application's security context.

The vulnerability was publicly reported via GitHub issues in the upstream repositories, accompanied by a proof-of-concept demonstrating the injection vector. EPSS probability rose from lower values to a peak of 0.0511 in December 2025 before receding to the current 0.0252, indicating a period of increased exploitation interest after initial disclosure.