CVE-2022-40849

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2022-12-01

Updated

2025-04-24

Proof-of-concept exploits (1)

• thinkcmf/thinkcmf/issues/7372159★ · 2025-11-20

Security advisories

• advisories/GHSA-m9mf-rqx6-2xpc

References

• CVE Record
• NVD entry

Related

• CVE-2018-19894
• CVE-2018-19895
• CVE-2018-19896
• CVE-2018-19897
• CVE-2018-19898
• CVE-2022-40489