CVE-2022-1175

Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.

• CWE-79

• http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.jsonVendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/353370Broken Link
• https://hackerone.com/reports/1481207Permissions Required, Third Party Advisory
• http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.htmlThird Party Advisory, VDB Entry
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.jsonVendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/353370Broken Link
• https://hackerone.com/reports/1481207Permissions Required, Third Party Advisory

Published

Apr 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1169There is a XSS vulnerability in Careerfy.6.1
• CVE-2022-1170In the Noo JobMonster WordPress theme before 4.5.2.9 JobMons…6.1
• CVE-2022-1171The Vertical scroll recent post WordPress plugin before 14.0…6.1
• CVE-2022-1172Null Pointer Dereference Caused Segmentation Fault in GitHub…5
• CVE-2022-1173stored xss in GitHub repository getgrav/grav prior to 1.7.33…5.4
• CVE-2022-1174A potential DoS vulnerability was discovered in Gitlab CE/EE…7.5
• CVE-2022-1176Loose comparison causes IDOR on multiple endpoints in GitHub…7.5
• CVE-2022-1177Accounting User Can Download Patient Reports in openemr in G…4.3
• CVE-2022-1178Stored Cross Site Scripting in GitHub repository openemr/ope…5.4
• CVE-2022-1179Non-Privilege User Can Created New Rule and Lead to Stored C…5.4
• CVE-2022-1180Reflected Cross Site Scripting in GitHub repository openemr/…3.5
• CVE-2022-1181Stored Cross Site Scripting in GitHub repository openemr/ope…5.4