CVE-2022-45037
Published: 25 November 2022
Summary
CVE-2022-45037 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Wbce Wbce Cms. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 13.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A cross-site scripting vulnerability exists in WBCE CMS version 1.5.4 within the file /admin/users/index.php. The flaw, tracked as CWE-79, permits injection of arbitrary web scripts or HTML through the Display Name field and carries a CVSS 3.1 score of 5.4 reflecting network attack vector, low attack complexity, and required low-privileged access combined with user interaction.
An authenticated user with limited privileges can supply a crafted payload in the Display Name field. When another user views the affected page, the injected script executes in the context of that user's session, enabling limited confidentiality and integrity impacts such as session token theft or unauthorized actions within the administrative interface.
The EPSS score for this CVE rose materially from a low baseline to a peak of 0.2132 on 2025-12-11 before receding to the current value of 0.0304, indicating a period of increased exploitation interest after disclosure. No further details on real-world exploitation campaigns or patch availability are provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-47962
Vulnerability details
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.