{"vulnerability": "CVE-2022-4662", "sightings": [{"uuid": "3f25fa3f-f78d-4855-88db-1f7cdc9825ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46624", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/9931", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-46624\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.\n\ud83d\udccf Published: 2023-01-25T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-01T15:20:36.135Z\n\ud83d\udd17 References:\n1. https://www.sourcecodester.com/php/15904/online-graduate-tracer-system-college-ict-alumni.html\n2. https://github.com/Rajeshwar40/CVE/blob/main/CVE-2022-46624", "creation_timestamp": "2025-04-01T15:32:53.000000Z"}, {"uuid": "42617ea1-c7d1-421a-a68a-b30db7979fb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46622", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10918", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-46622\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.\n\ud83d\udccf Published: 2023-01-12T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-08T14:28:59.093Z\n\ud83d\udd17 References:\n1. https://github.com/sudoninja-noob/CVE-2022-46622/blob/main/CVE-2022-46622", "creation_timestamp": "2025-04-08T14:47:11.000000Z"}, {"uuid": "8dfb75cb-1e9e-461b-ae2b-5bd99d7295a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46623", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/10922", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-46623\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.\n\ud83d\udccf Published: 2023-01-12T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-08T14:27:28.452Z\n\ud83d\udd17 References:\n1. https://github.com/sudoninja-noob/CVE-2022-46623/blob/main/CVE-2022-46623", "creation_timestamp": "2025-04-08T14:47:15.000000Z"}, {"uuid": "39704d1c-9733-446c-85b4-2ec57ebc132f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4662", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/11132", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-4662\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.\n\ud83d\udccf Published: 2022-12-22T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-09T18:36:53.874Z\n\ud83d\udd17 References:\n1. https://lore.kernel.org/all/CAB7eexLLApHJwZfMQ=X-PtRhw0BgO+5KcSMS05FNUYejJXqtSA%40mail.gmail.com/\n2. https://lore.kernel.org/all/20220913140355.910732567%40linuxfoundation.org/", "creation_timestamp": "2025-04-09T18:48:03.000000Z"}, {"uuid": "dba0d9ff-08f5-4ac1-bb22-64cb2ecc5c32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46622", "type": "seen", "source": "https://t.me/cibsecurity/56457", "content": "\u203c CVE-2022-46622 \u203c\n\nA cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-13T00:30:39.000000Z"}, {"uuid": "7d860ad4-e8d2-4ddc-96d0-7eaf6ea9512b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46623", "type": "seen", "source": "https://t.me/cibsecurity/56456", "content": "\u203c CVE-2022-46623 \u203c\n\nJudging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-13T00:30:38.000000Z"}, {"uuid": "9b145887-b8b1-4a0d-b097-d1e364ab97dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46620", "type": "seen", "source": "https://t.me/hacking_Attack/84440", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page:  https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:11.580363Z"}, {"uuid": "3cf255d1-89b0-4e4d-8e0d-cbd84fd51042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46620", "type": "seen", "source": "https://t.me/hacking_Attack/84440", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page:  https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:28.094977Z"}, {"uuid": "10cd5c50-2205-4b15-a627-a69019edcb57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-46620", "type": "seen", "source": "https://t.me/hacking_Attack/84440", "content": "Exploit Collector\nMOV.AI Robotics Engine 2.2.3-3 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png \nMOV.AI Robotics Engine version 2.2.3-3 suffers from multiple cross site scripting vulnerabilities.\n\nSHA-256 | b4fade716d8cdd82f18de5a3e6c65b0d1b1d58bb728ae8e16d265e61aa6541f7\n\nDownload\nVendor Name: MOV.AI\nProduct Name: MOV.AI Robotics Engine\nVendor Home Page:  https://www.mov.ai\nAffected Version(s): MOV.AI Robotics Engine v2.2.3-3\nPatch Release: MOV.AI Robotics Engine v2.2.3-4\nPatched Version Release: 22 September 2022\nVulnerability Type: Reflected XSS (CWE-79)\nCVE Reference: CVE-2022-46620\nAuthor of Advisory: Thurein Soe\nVendor Description:\nMOV.AI is a Robotics Engine platform based on ROS. It is packaged in an\nintuitive web-based interface to develop autonomous mobile robots (AMRs)\nand automated guided vehicles (AGVs). It integrates with navigation,\nlocalization, calibration, and the enterprise-grade tools they need for\nadvanced automation.\n\nVulnerability description:\nPost Reflected cross-site scripting (XSS) vulnerability in MOV.AI Robotics\nEngine v2.2.3-3 version allowing an attacker to execute arbitrary\njavascript in the context of RCS application due to inadequate sanitization\nof user-supplied data. During the Assessment, it was possible to send\narbitrary JavaScript, and the server returned as part of an application\nresponse body due to insufficient input validation.\n\nVulnerable Parameters:\n\ndashboard/users/admin2\ndashboard/groups\nAdminBoard\n\nImpact:\nCross-Site Scripting issues occur when an application uses untrusted data\nsupplied by untrusted users in a web browser without sufficient prior\nvalidation or escaping. A potential attacker can embed untrusted code\nwithin a client-side script to be executed by the browser while\ninterpreting the page. Attackers utilize XSS vulnerabilities to execute\nscripts in a legitimate user's browser leading to user credentials theft,\nsession hijacking, website defacement, or redirection to malicious sites.\n\nReferences:\nhttps://www.immuniweb.com/vulnerability/cross-site-scripting.html\n\nDisclosure Timeline:\n06 July 2022: Found security vulnerability during a security assessment\n08 July 2022: Customer reported finding a security vulnerability to MOV.AI\n15 September 2022: further details of remediation steps sent to MOV.AI\n22 September 2022: Patch released for MOV.AI Customer by MOV.AI\n\nCredits:\nThurein Soe\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T00:00:10.313771Z"}]}