VULNERABILITY INTELLIGENCE

CVE-2022-28599

CVSS score5.4 MEDIUM

EPSS probability0.57%

CISA KEVNot currently listed

Published2022-05-03

Last modified2026-06-17

Description

A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.