CVE-2022-4585

A vulnerability classified as problematic has been found in Opencaching Deutschland oc-server3. This affects an unknown part of the file htdocs/templates2/ocstyle/start.tpl of the component Cookie Handler. The manipulation of the argument usercountryCode leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is c720f2777a452186c67ef30db3679dd409556544. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216171.

• CWE-707
• CWE-79

• https://github.com/OpencachingDeutschland/oc-server3/commit/c720f2777a452186c67ef30db3679dd409556544Patch, Third Party Advisory
• https://github.com/OpencachingDeutschland/oc-server3/pull/894Patch, Third Party Advisory
• https://vuldb.com/?id.216171Third Party Advisory
• https://github.com/OpencachingDeutschland/oc-server3/commit/c720f2777a452186c67ef30db3679dd409556544Patch, Third Party Advisory
• https://github.com/OpencachingDeutschland/oc-server3/pull/894Patch, Third Party Advisory
• https://vuldb.com/?id.216171Third Party Advisory

Published

Dec 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45843Auth. (contributor+) Stored Cross-Site Scripting vulnerabili…5.4
• CVE-2022-45845Deserialization of Untrusted Data vulnerability in Nextend S…8.8
• CVE-2022-45846Cross-Site Request Forgery (CSRF) vulnerability in Nickys Im…8.8
• CVE-2022-45847Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.…6.1
• CVE-2022-45848Unauth. Stored Cross-Site Scripting (XSS) vulnerability in C…6.1
• CVE-2022-45849Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vul…5.4
• CVE-2022-45850Cross-Site Request Forgery (CSRF) vulnerability in Nickys Im…6.1
• CVE-2022-45851Missing Authorization vulnerability in ShareThis ShareThis D…5.4
• CVE-2022-45852Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2022-45853The privilege escalation vulnerability in the Zyxel GS1900-8…6.7
• CVE-2022-45854An improper check for unusual conditions in Zyxel NWA110AX f…4.3
• CVE-2022-45855SpringEL injection in the metrics source in Apache Ambari ve…8.8