CVE-2022-46889

A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.

• CWE-79
• CWE-79

• https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33Release Notes, Third Party Advisory
• https://www.surecloud.com/resources/blog/nexusphp-surecloud-security-review-identifies-authenticated-unauthenticated-vulnerabilitiesThird Party Advisory
• https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33Release Notes, Third Party Advisory
• https://www.surecloud.com/resources/blog/nexusphp-surecloud-security-review-identifies-authenticated-unauthenticated-vulnerabilitiesThird Party Advisory

Published

Jan 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46883Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew M…8.8
• CVE-2022-46884A potential use-after-free vulnerability existed in SVG Imag…8.8
• CVE-2022-46885Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozi…8.8
• CVE-2022-46886There exists an open redirect within the response list updat…6.1
• CVE-2022-46887Multiple SQL injection vulnerabilities in NexusPHP before 1.…9.8
• CVE-2022-46888Multiple reflective cross-site scripting (XSS) vulnerabiliti…6.1
• CVE-2022-4689Improper Access Control in GitHub repository usememos/memos …8.8
• CVE-2022-46890Weak access control in NexusPHP before 1.7.33 allows a remot…4.3
• CVE-2022-46891An issue was discovered in the Arm Mali GPU Kernel Driver. T…8.8
• CVE-2022-46892In Ampere AltraMax and Ampere Altra before 2.10c, improper a…9.8
• CVE-2022-46897An issue was discovered in Insyde InsydeH2O with kernel 5.0 …5.3
• CVE-2022-46898An issue was discovered in Vocera Report Server and Voice Se…9.8