CVE-2022-25349

All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as <not-a-tag />) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.

• CWE-79

• https://github.com/Dogfalo/materialize/blob/v1-dev/js/autocomplete.js%23L285%20Broken Link
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2766498Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MATERIALIZECSS-2324800Exploit, Third Party Advisory
• https://github.com/Dogfalo/materialize/blob/v1-dev/js/autocomplete.js%23L285%20Broken Link
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2766498Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-MATERIALIZECSS-2324800Exploit, Third Party Advisory

Published

May 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25342An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.…8.1
• CVE-2022-25343An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.…7.5
• CVE-2022-25344An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S…6.1
• CVE-2022-25345All versions of package @discordjs/opus are vulnerable to De…7.5
• CVE-2022-25347Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…7.5
• CVE-2022-25348Untrusted search path vulnerability in AttacheCase ver.4.0.2…7.8
• CVE-2022-2535The SearchWP Live Ajax Search WordPress plugin before 1.6.2 …5.3
• CVE-2022-25350All versions of the package puppet-facter are vulnerable to …7.8
• CVE-2022-25352The package libnested before 1.5.2 are vulnerable to Prototy…9.8
• CVE-2022-25354The package set-in before 2.0.3 are vulnerable to Prototype …9.8
• CVE-2022-25355EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improp…5.3
• CVE-2022-25356Alt-N MDaemon Security Gateway through 8.5.0 allows Security…5.3