CVE-2022-24710

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed in the 4.11 release. Users unable to upgrade are advised to add their own neutralize logic.

• CWE-79

• https://github.com/WeblateOrg/weblate/commit/22d577b1f1e88665a88b4569380148030e0f8389Patch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/commit/9e19a8414337692cc90da2a91c9af5420f2952f1Patch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/commit/f6753a1a1c63fade6ad418fbda827c6750ab0bdaPatch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6jp6-9rf9-gc66Patch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/commit/22d577b1f1e88665a88b4569380148030e0f8389Patch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/commit/9e19a8414337692cc90da2a91c9af5420f2952f1Patch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/commit/f6753a1a1c63fade6ad418fbda827c6750ab0bdaPatch, Third Party Advisory
• https://github.com/WeblateOrg/weblate/security/advisories/GHSA-6jp6-9rf9-gc66Patch, Third Party Advisory

Published

Feb 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24705The rad_packet_recv function in radius/packet.c suffers from…9.8
• CVE-2022-24706In Apache CouchDB prior to 3.2.2, an attacker can access an …9.8
• CVE-2022-24707Anuko Time Tracker is an open source, web-based time trackin…8.8
• CVE-2022-24708Anuko Time Tracker is an open source, web-based time trackin…5.4
• CVE-2022-24709@awsui/components-react is the main AWS UI package which con…6.1
• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8
• CVE-2022-24712CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…8.8
• CVE-2022-24713regex is an implementation of regular expressions for the Ru…7.5
• CVE-2022-24714Icinga Web 2 is an open source monitoring web interface, fra…5.3
• CVE-2022-24715Icinga Web 2 is an open source monitoring web interface, fra…8.8
• CVE-2022-24716Icinga Web 2 is an open source monitoring web interface, fra…7.5