CVE-2022-25256

SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button, e.g., a malicious web page. In addition, the second parameter executes JavaScript, which means XSS is possible by adding a javascript: URL.

• CWE-79

• https://github.com/RobertDra/CVE-2022-25256Broken Link
• https://sas.comProduct
• https://support.sas.com/kb/62/972.htmlVendor Advisory
• https://github.com/RobertDra/CVE-2022-25256Broken Link
• https://sas.comProduct
• https://support.sas.com/kb/62/972.htmlVendor Advisory

Published

Feb 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25249When connecting to a certain port Axeda agent (All versions)…7.5
• CVE-2022-2525Improper Restriction of Excessive Authentication Attempts in…9.8
• CVE-2022-25250When connecting to a certain port Axeda agent (All versions)…7.5
• CVE-2022-25251When connecting to a certain port Axeda agent (All versions)…9.8
• CVE-2022-25252When connecting to a certain port Axeda agent (All versions)…7.5
• CVE-2022-25255In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.…7.8
• CVE-2022-25258An issue was discovered in drivers/usb/gadget/composite.c in…4.6
• CVE-2022-25259JetBrains Hub before 2021.1.14276 was vulnerable to reflecte…6.1
• CVE-2022-2526A use-after-free vulnerability was found in systemd. This is…9.8
• CVE-2022-25260JetBrains Hub before 2021.1.14276 was vulnerable to blind Se…9.1
• CVE-2022-25261JetBrains TeamCity before 2021.2.2 was vulnerable to reflect…6.1
• CVE-2022-25262In JetBrains Hub before 2022.1.14434, SAML request takeover …9.8