CVE-2022-25869

All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

• CWE-79
• CWE-79

• https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869
• https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617
• https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782
• https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
• https://glitch.com/edit/%23%21/angular-repro-textarea-xssBroken Link
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-ANGULAR-2949781Exploit, Third Party Advisory

Published

Jul 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25863The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and …9.8
• CVE-2022-25864Uncontrolled search path in some Intel(R) oneMKL software be…7.8
• CVE-2022-25865The package workspace-tools before 0.18.4 are vulnerable to …9.8
• CVE-2022-25866The package czproject/git-php before 4.0.3 are vulnerable to…9.8
• CVE-2022-25867The package io.socket:socket.io-client before 2.0.1 are vuln…7.5
• CVE-2022-25868Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-2587Out of bounds write in Chrome OS Audio Server in Google Chro…9.8
• CVE-2022-25870Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-25871All versions of package querymen are vulnerable to Prototype…7.5
• CVE-2022-25872All versions of package fast-string-search are vulnerable to…5.3
• CVE-2022-25873The package vuetify from 2.0.0-beta.4 and before 2.6.10 are …5.4
• CVE-2022-25875The package svelte before 3.49.0 are vulnerable to Cross-sit…6.1