CVE-2022-1526

A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used.

• CWE-79
• CWE-79

• https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/emlog%3C=pro-1.2.2%20Stored%20Cross-Site%20Scripting%28XSS%29.md
• https://vuldb.com/?id.198705Third Party Advisory
• https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/emlog%3C=pro-1.2.2%20Stored%20Cross-Site%20Scripting%28XSS%29.md
• https://vuldb.com/?id.198705Third Party Advisory

Published

Apr 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1520When viewing an email message A, which contains an attached …4.3
• CVE-2022-1521LRM does not implement authentication or authorization by de…9.1
• CVE-2022-1522The Cognex 3D-A1000 Dimensioning System in firmware version …5.3
• CVE-2022-1523Fuji Electric D300win prior to version 3.7.1.17 is vulnerabl…9.1
• CVE-2022-1524LRM version 2.4 and lower does not implement TLS encryption.…5.9
• CVE-2022-1525The Cognex 3D-A1000 Dimensioning System in firmware version …9.1
• CVE-2022-1527The WP 2FA WordPress plugin before 2.2.1 does not sanitise a…6.1
• CVE-2022-1528The VikBooking Hotel Booking Engine & PMS WordPress plugin b…6.1
• CVE-2022-1529An attacker could have sent a message to the parent process …8.8
• CVE-2022-1530Cross-site Scripting (XSS) in GitHub repository livehelperch…6.1
• CVE-2022-1531SQL injection vulnerability in ARAX-UI Synonym Lookup functi…9.8
• CVE-2022-1532Themify WordPress plugin before 1.3.8 does not sanitise and …6.1