CVE-2022-41392

A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings.

• CWE-79

• https://github.com/totaljs/cms/issues/38Exploit, Issue Tracking, Third Party Advisory
• https://www.edoardoottavianelli.it/CVE-2022-41392/Exploit, Third Party Advisory
• https://www.youtube.com/watch?v=BOPLYnveBqkExploit, Third Party Advisory
• https://github.com/totaljs/cms/issues/38Exploit, Issue Tracking, Third Party Advisory
• https://www.edoardoottavianelli.it/CVE-2022-41392/Exploit, Third Party Advisory
• https://www.youtube.com/watch?v=BOPLYnveBqkExploit, Third Party Advisory

Published

Oct 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41385The d8s-html package for Python, as distributed on PyPI, inc…9.8
• CVE-2022-41386The d8s-utility package for Python, as distributed on PyPI, …9.8
• CVE-2022-41387The d8s-pdfs package for Python, as distributed on PyPI, inc…9.8
• CVE-2022-4139An incorrect TLB flush issue was found in the Linux kernel’s…7.8
• CVE-2022-41390OcoMon v4.0 was discovered to contain a SQL injection vulner…9.8
• CVE-2022-41391OcoMon v4.0 was discovered to contain a SQL injection vulner…9.8
• CVE-2022-41395Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was disco…7.8
• CVE-2022-41396Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was disco…7.8
• CVE-2022-41397The optional Web Screens and Global Search features for Sage…9.8
• CVE-2022-41398The optional Global Search feature for Sage 300 through vers…7.5
• CVE-2022-41399The optional Web Screens feature for Sage 300 through versio…7.5
• CVE-2022-4140The Welcart e-Commerce WordPress plugin before 2.8.5 does no…7.5