CVE-2022-4560

A vulnerability was found in Joget up to 7.0.31. It has been rated as problematic. This issue affects the function getInternalJsCssLib of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UniversalTheme.java of the component wflow-core. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.32 is able to address this issue. The name of the patch is ecf8be8f6f0cb725c18536ddc726d42a11bdaa1b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215963.

• CWE-79
• CWE-79

• https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bPatch
• https://github.com/jogetworkflow/jw-community/releases/tag/7.0.32Release Notes
• https://vuldb.com/?id.215963Third Party Advisory
• https://github.com/jogetworkflow/jw-community/commit/ecf8be8f6f0cb725c18536ddc726d42a11bdaa1bPatch
• https://github.com/jogetworkflow/jw-community/releases/tag/7.0.32Release Notes
• https://vuldb.com/?id.215963Third Party Advisory

Published

Dec 16, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45588All versions before R2022-09 of Talend's Remote Engine Gen 2…7.8
• CVE-2022-45589All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT …7.2
• CVE-2022-4559A vulnerability was found in INEX IPX-Manager up to 6.2.0. I…6.1
• CVE-2022-45597ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validatio…9.8
• CVE-2022-45598Cross Site Scripting vulnerability in Joplin Desktop App bef…6.1
• CVE-2022-45599Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vu…9.8
• CVE-2022-45600Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devic…8.8
• CVE-2022-45608An issue was discovered in ThingsBoard 3.4.1, allows low pri…8.8
• CVE-2022-4561A vulnerability classified as problematic has been found in …6.1
• CVE-2022-45611An issue was discovered in Fresenius Kabi PharmaHelp 5.1.759…9.8
• CVE-2022-45613Book Store Management System v1.0 was discovered to contain …5.4
• CVE-2022-45614Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…