CVE-2022-36254 json
Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers…
published 2022-09-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-38972
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Multiple persistent cross-site scripting (XSS) vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname".
Exploit prediction
0.78% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/ziyishen97/c464b459df73c4cef241e7ec774b7cf6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
gist.github.com
/ziyishen97/c464b459df73c4cef241e7ec774b7cf6
exploit, third-party-advisory
-
github.com
/tramyardg/hotel-mgmt-system
product, third-party-advisory
Sources
- CVE List CVE-2022-36254
- NVD CVE-2022-36254
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.