CVE-2022-40178

A vulnerability has been identified in Desigo PXM30-1 (All versions < V02.20.126.11-41), Desigo PXM30.E (All versions < V02.20.126.11-41), Desigo PXM40-1 (All versions < V02.20.126.11-41), Desigo PXM40.E (All versions < V02.20.126.11-41), Desigo PXM50-1 (All versions < V02.20.126.11-41), Desigo PXM50.E (All versions < V02.20.126.11-41), PXG3.W100-1 (All versions < V02.20.126.11-37), PXG3.W100-2 (All versions < V02.20.126.11-41), PXG3.W200-1 (All versions < V02.20.126.11-37), PXG3.W200-2 (All versions < V02.20.126.11-41). Improper Neutralization of Input During Web Page Generation exists in the “Import Files“ functionality of the “Operation” web application, due to the missing validation of the titles of files included in the input package. By uploading a specifically crafted graphics package, a remote low-privileged attacker can execute arbitrary JavaScript code.

• CWE-79

• https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdfPatch, Vendor Advisory

Published

Oct 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40172Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40173Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40174Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40175Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-40176A vulnerability has been identified in Desigo PXM30-1 (All v…8
• CVE-2022-40177A vulnerability has been identified in Desigo PXM30-1 (All v…5.7
• CVE-2022-40179A vulnerability has been identified in Desigo PXM30-1 (All v…8.1
• CVE-2022-4018Missing Authentication for Critical Function in GitHub repos…4.3
• CVE-2022-40180A vulnerability has been identified in Desigo PXM30-1 (All v…5.3
• CVE-2022-40181A vulnerability has been identified in Desigo PXM30-1 (All v…8.3
• CVE-2022-40182A vulnerability has been identified in Desigo PXM30-1 (All v…8.8
• CVE-2022-40183An error in the URL handler of the VIDEOJET multi 4000 may l…4.7