CVE-2022-4859

A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.

• CWE-79
• CWE-79

• https://github.com/jogetworkflow/jw-community/commit/9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8Patch
• https://github.com/jogetworkflow/jw-community/releases/tag/7.0.34Release Notes
• https://vuldb.com/?ctiid.217055Permissions Required
• https://vuldb.com/?id.217055Third Party Advisory
• https://github.com/jogetworkflow/jw-community/commit/9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8Patch
• https://github.com/jogetworkflow/jw-community/releases/tag/7.0.34Release Notes
• https://vuldb.com/?ctiid.217055Permissions Required
• https://vuldb.com/?id.217055Third Party Advisory

Published

Dec 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-48584A command injection vulnerability exists in the download and…8.8
• CVE-2022-48585A SQL injection vulnerability exists in the “admin brand por…8.8
• CVE-2022-48586A SQL injection vulnerability exists in the “json walker” fe…8.8
• CVE-2022-48587A SQL injection vulnerability exists in the “schedule editor…8.8
• CVE-2022-48588A SQL injection vulnerability exists in the “schedule editor…8.8
• CVE-2022-48589A SQL injection vulnerability exists in the “reporting job e…8.8
• CVE-2022-48590A SQL injection vulnerability exists in the “admin dynamic a…8.8
• CVE-2022-48591A SQL injection vulnerability exists in the vendor_state par…8.8
• CVE-2022-48592A SQL injection vulnerability exists in the vendor_country p…8.8
• CVE-2022-48593A SQL injection vulnerability exists in the “topology data s…8.8
• CVE-2022-48594A SQL injection vulnerability exists in the “ticket watchers…8.8
• CVE-2022-48595A SQL injection vulnerability exists in the “ticket template…8.8