CVE-2022-40849 - CVE House
Back to Database
Status published Unknown CVE-2022-40849

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS)....

Vulnerability Description

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-40849

Credits & Attribution

No credits recorded in the NVD database.

References

More from thinkcmf

View All →
CVE-2022-40489
ThinkCMF version 6.0.7 is affected by a Cross Site Request...
Unknown 0
CVE-2021-40616
thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify...
Medium 6.5
CVE-2020-25915
Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version...
Medium 5.4
CVE-2020-20601
An issue in ThinkCMF X2.2.2 and below allows attackers to...
Critical 9.8
CVE-2020-18151
Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which...
Medium 6.5

Affected Vendor

Affected Software

thinkcmf
Vulnerable Versions:
6.0.7

Timeline

Official Publish: December 1st, 2022
Last Modified: April 24th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.