CVE-2022-42992

Summary

Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://train.com
• http://oretnom23.com
• https://github.com/draco1725/POC/blob/main/Exploit/Train%20Scheduler%20App/XSS

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/draco1725/POC/blob/main/Exploit/Train%20Scheduler%20App/XSS

• ←Previous
• Next→