CVE-2022-23637

K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.

• CWE-79
• CWE-79

• https://github.com/k-box/k-box/commit/3bb4df9a4d01aade5bffaa603a514d1a5fabd214Patch, Third Party Advisory
• https://github.com/k-box/k-box/security/advisories/GHSA-wwcw-h4mf-mvxfThird Party Advisory
• https://github.com/k-box/k-box/commit/3bb4df9a4d01aade5bffaa603a514d1a5fabd214Patch, Third Party Advisory
• https://github.com/k-box/k-box/security/advisories/GHSA-wwcw-h4mf-mvxfThird Party Advisory

Published

Feb 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23631superjson is a program to allow JavaScript expressions to be…9.8
• CVE-2022-23632Traefik is an HTTP reverse proxy and load balancer. Prior to…7.5
• CVE-2022-23633Action Pack is a framework for handling and responding to we…5.9
• CVE-2022-23634Puma is a Ruby/Rack web server built for parallelism. Prior …5.9
• CVE-2022-23635Istio is an open platform to connect, manage, and secure mic…7.5
• CVE-2022-23636Wasmtime is an open source runtime for WebAssembly & WASI. P…8.1
• CVE-2022-23638svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross…6.1
• CVE-2022-23639crossbeam-utils provides atomics, synchronization primitives…8.1
• CVE-2022-2364A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2022-23640Excel-Streaming-Reader is an easy-to-use implementation of a…9.8
• CVE-2022-23641Discourse is an open source discussion platform. In versions…6.5
• CVE-2022-23642Sourcegraph is a code search and navigation engine. Sourcegr…8.8