CVE-2022-36180
Critical · CVSS 9.6FusionDirectory — Reflected Cross-Site Scripting (XSS)
- CVSS
- 9.6
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-79, CWE-79
Description
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106.
Search profile — drives PoC discovery
Symbols index.phpmessageplugsignoutinvalidparametermessage=[injection]plug={Injection]
Keywords CVE-2022-36180FusionDirectory XSSFusionDirectory 1.3 Cross Site Scriptingfusiondirectory index.php message injectionFusionDirectory reflected XSSFusionDirectory plug parameter XSSFusionDirectory signout message XSS
Versions: 1.3
References
- https://lists.debian.org/debian-lts-announce/2023/07/msg00009.html
- https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/
- http://fusiondirectory.com
- https://lists.debian.org/debian-lts-announce/2023/07/msg00009.html
- https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z