https://vulnerability.circl.lu/sightings/feed 2026-09-05T07:54:54.342250+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/10cd5c50-2205-4b15-a627-a69019edcb57/export 2026-09-05T07:54:54.361249+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "10cd5c50-2205-4b15-a627-a69019edcb57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46620", "type": "seen", "source": "https://t.me/hacking_Attack/84440", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page: https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T00:00:10.313771Z"} 2026-09-05T00:00:10.313771+00:00 https://vulnerability.circl.lu/sighting/3cf255d1-89b0-4e4d-8e0d-cbd84fd51042/export 2026-09-05T07:54:54.363503+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3cf255d1-89b0-4e4d-8e0d-cbd84fd51042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46620", "type": "seen", "source": "https://t.me/hacking_Attack/84440", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page: https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:28.094977Z"} 2026-09-02T01:01:28.094977+00:00 https://vulnerability.circl.lu/sighting/9b145887-b8b1-4a0d-b097-d1e364ab97dd/export 2026-09-05T07:54:54.363663+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9b145887-b8b1-4a0d-b097-d1e364ab97dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46620", "type": "seen", "source": "https://t.me/hacking_Attack/84440", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page: https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:11.580363Z"} 2026-09-01T20:01:11.580363+00:00