CVE-2022-4068

A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sanitized in the admin user overview. This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account.

• CWE-915
• CWE-79

• https://github.com/librenms/librenms/commit/09a2977adb8bc4b1db116c725d661160c930d3a1Patch, Third Party Advisory
• https://huntr.dev/bounties/becfecc4-22a6-4f94-bf83-d6030b625fdcExploit, Patch, Third Party Advisory
• https://github.com/librenms/librenms/commit/09a2977adb8bc4b1db116c725d661160c930d3a1Patch, Third Party Advisory
• https://huntr.dev/bounties/becfecc4-22a6-4f94-bf83-d6030b625fdcExploit, Patch, Third Party Advisory

Published

Nov 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40674libexpat before 2.4.9 has a use-after-free in the doContent …8.1
• CVE-2022-40675Some cryptographic issues in Fortinet FortiNAC versions 9.4.…7.4
• CVE-2022-40676A improper neutralization of input during web page generatio…5.4
• CVE-2022-40677A improper neutralization of argument delimiters in a comman…8.8
• CVE-2022-40678An insufficiently protected credentials in Fortinet FortiNAC…7.8
• CVE-2022-40679An improper neutralization of special elements used in an OS…7.8
• CVE-2022-40680A improper neutralization of input during web page generatio…5.4
• CVE-2022-40681A incorrect authorization in Fortinet FortiClient (Windows) …7.1
• CVE-2022-40682A incorrect authorization in Fortinet FortiClient (Windows) …7.8
• CVE-2022-40683A double free in Fortinet FortiWeb version 7.0.0 through 7.0…7.8
• CVE-2022-40684An authentication bypass using an alternate path or channel …9.8
• CVE-2022-40685Insufficiently protected credentials in the Intel(R) DCM sof…6.5