CVE-2022-50940
Knap Advanced PHP Login 3.1.3 Persistent Cross-Site Scripting via Name Parameter
MEDIUM 5.1EPSS 0.4%
Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name parameter. Attackers can exploit the vulnerability to execute arbitrary scripts in users and activity log backend modules, potentially leading to session hijacking and persistent phishing attacks.
- Affected
- ajay138 · Knap Advanced PHP Login
- CVSS v4.0 VULNCHECK
- 5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1 VULNCHECK
- 6.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - EPSS
- 0.35% chance of exploitation in the next 30 days, 27th percentile
- Published
- 2026-02-01
- Updated
- 2026-02-03