CVE-2022-37431

A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTECTION_ENABLED=false. NOTE: the vendor disputes this because the current product behavior, in effect, has XSS_PROTECTION_ENABLED=true in all configurations

• CWE-79

• https://fortiguard.fortinet.com/zeroday/FG-VD-22-062Third Party Advisory
• https://fortiguard.fortinet.com/zeroday/FG-VD-22-062Third Party Advisory

Published

Aug 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37425Improper Neutralization of Special Elements used in a Comman…9.8
• CVE-2022-37426Unrestricted Upload of File with Dangerous Type vulnerabilit…7.5
• CVE-2022-37428PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1…6.5
• CVE-2022-37429Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
• CVE-2022-3743A potential vulnerability was discovered in LCFC BIOS for so…4.4
• CVE-2022-37430Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
• CVE-2022-37434zlib through 1.2.12 has a heap-based buffer over-read or buf…9.8
• CVE-2022-37435Apache ShenYu Admin has insecure permissions, which may allo…8.8
• CVE-2022-37436Prior to Apache HTTP Server 2.4.55, a malicious backend can …5.3
• CVE-2022-37437When using Ingest Actions to configure a destination that re…9.8
• CVE-2022-37438In Splunk Enterprise versions in the following table, an aut…3.5
• CVE-2022-37439In Splunk Enterprise and Universal Forwarder versions in the…5.5