CVE-2022-37720
Critical · CVSS 9.0Orchard CMS — Stored Cross-Site Scripting (XSS) leading to privilege escalation / account takeover
- CVSS
- 9.0
- nvd
- EPSS
- 0.96%
- 57th pct
- KEV
- No
- Class
- other
- CWE-79, CWE-79
Description
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.
Search profile — drives PoC discovery
Symbols blog posthtml payloadjavascript payloadauthorpublisheradmin account takeoverprivilege escalation
Keywords CVE-2022-37720Orchard CMS XSSOrchardProject 1.10.3 XSSOrchard CMS stored XSSOrchard CMS privilege escalationOrchard CMS blog post XSSOrchard CMS account takeoverorchardproject XSS PoC
Versions: 1.10.3
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T12:30:39.000Z