CVE-2022-1536 — automad Dashboard cross site scripting

leads to a cross site scripting. The attack can be initiated remotel","mainEntity":{"@type":"Thing","name":"CVE-2022-1536","identifier":"CVE-2022-1536","description":"automad Dashboard cross site scripting"},"isPartOf":{"@type":"WebSite","name":"VulnTracker","url":"https://vulntracker.io"}}</script><div class="cv-page flex min-h-screen"><style> .cv-page { --cv-bg: oklch(98.5% 0.004 85); --cv-bg-alt: oklch(96% 0.006 85); --cv-ink: oklch(18% 0.012 280); --cv-ink-2: oklch(35% 0.015 280); --cv-ink-3: oklch(55% 0.015 280); --cv-line: oklch(90% 0.008 280); --cv-line-2: oklch(94% 0.006 280); --cv-accent: oklch(52% 0.22 295); --cv-accent-2: oklch(62% 0.19 295); --cv-accent-soft: oklch(95% 0.04 295); --cv-accent-ink: oklch(30% 0.15 295); --cv-red: oklch(58% 0.22 25); --cv-red-soft: oklch(96% 0.03 25); --cv-amber: oklch(72% 0.17 75); --cv-amber-soft: oklch(96% 0.04 75); --cv-green: oklch(58% 0.16 155); --cv-green-soft: oklch(95% 0.04 155); background: var(--cv-bg) !important; } .cv-page .bg-white { background: var(--cv-bg) !important; } .cv-page .bg-white.rounded-xl.shadow-lg, .cv-page .bg-white.rounded-xl.shadow-md, .cv-page .bg-white.rounded-xl.shadow-sm, .cv-page .bg-white.rounded-lg.shadow-sm, .cv-page .bg-white.rounded-2xl.shadow-xl { background: var(--cv-bg) !important; border: 1px solid var(--cv-line) !important; box-shadow: 0 10px 30px -18px oklch(20% 0.05 280 / 0.12) !important; border-radius: 16px !important; } .cv-page .bg-gray-50 { background: var(--cv-bg-alt) !important; } .cv-page .border-gray-100 { border-color: var(--cv-line-2) !important; } .cv-page .border-gray-200 { border-color: var(--cv-line) !important; } .cv-page .text-brand-600 { color: var(--cv-accent) !important; } .cv-page .text-brand-700, .cv-page .text-brand-800 { color: var(--cv-accent-ink) !important; } .cv-page .text-brand-500 { color: var(--cv-accent-2) !important; } .cv-page .bg-brand-50 { background: var(--cv-accent-soft) !important; } .cv-page .bg-brand-100 { background: oklch(92% 0.05 295) !important; } .cv-page .bg-brand-600 { background: var(--cv-accent) !important; } .cv-page .hover\:bg-brand-700:hover { background: var(--cv-accent-2) !important; } .cv-page .hover\:text-brand-700:hover, .cv-page .hover\:text-brand-800:hover { color: var(--cv-accent) !important; } .cv-page .border-brand-200 { border-color: oklch(88% 0.06 295) !important; } .cv-page .border-brand-300, .cv-page .border-brand-400 { border-color: var(--cv-accent) !important; } .cv-page .ring-red-400 { --tw-ring-color: var(--cv-red) !important; } .cv-page h1, .cv-page h2, .cv-page h3 { letter-spacing: -0.02em; } </style><style> .sb { --sb-bg: oklch(98.5% 0.004 85); --sb-bg-alt: oklch(96% 0.006 85); --sb-ink: oklch(18% 0.012 280); --sb-ink-2: oklch(35% 0.015 280); --sb-ink-3: oklch(55% 0.015 280); --sb-line: oklch(90% 0.008 280); --sb-line-2: oklch(94% 0.006 280); --sb-accent: oklch(52% 0.22 295); --sb-accent-2: oklch(62% 0.19 295); --sb-accent-soft: oklch(95% 0.04 295); --sb-accent-ink: oklch(30% 0.15 295); --sb-green: oklch(58% 0.16 155); font-family: 'Inter', system-ui, sans-serif; background: var(--sb-bg); color: var(--sb-ink); border-right: 1px solid var(--sb-line); } .sb-mono { font-family: 'JetBrains Mono', ui-monospace, monospace; } .sb-serif { font-family: 'Instrument Serif', Georgia, serif; font-style: italic; font-weight: 400; } .sb-brand { display: inline-flex; align-items: center; gap: 8px; text-decoration: none; color: var(--sb-ink); font-weight: 700; font-size: 17px; letter-spacing: -0.02em; } .sb-brand img { width: 28px; height: 28px; object-fit: contain; flex-shrink: 0; } .sb-brand .accent { color: var(--sb-accent); } .sb-section-label { padding: 6px 10px; font-family: 'JetBrains Mono', monospace; font-size: 10px; letter-spacing: 0.1em; text-transform: uppercase; color: var(--sb-ink-3); font-weight: 600; } .sb-item { width: 100%; display: flex; align-items: center; justify-content: space-between; padding: 8px 10px; background: transparent; border: 1px solid transparent; border-radius: 10px; color: var(--sb-ink-2); font-size: 13px; font-weight: 500; cursor: pointer; font-family: inherit; transition: all 0.12s; text-align: left; } .sb-item:hover { background: var(--sb-bg-alt); color: var(--sb-ink); } .sb-item.active { background: var(--sb-accent-soft); color: var(--sb-accent-ink); border-color: oklch(90% 0.05 295); } .sb-item.active .sb-item-icon { color: var(--sb-accent); } .sb-item-left { display: inline-flex; align-items: center; gap: 10px; min-width: 0; } .sb-item-icon { flex-shrink: 0; color: var(--sb-ink-3); transition: color 0.12s; } .sb-item:hover .sb-item-icon { color: var(--sb-ink-2); } .sb-item.collapsed { justify-content: center; padding: 8px; } .sb-hint-pill { padding: 2px 9px; font-size: 10px; font-weight: 600; font-family: 'JetBrains Mono', monospace; background: var(--sb-green); color: white; border-radius: 99px; letter-spacing: 0.02em; white-space: nowrap; animation: sbpulse 1.6s ease-in-out infinite; } .sb-hint-dot { width: 8px; height: 8px; background: var(--sb-green); border-radius: 50%; position: absolute; top: -2px; right: -2px; animation: sbpulse 1.6s ease-in-out infinite; } @keyframes sbpulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.5; } } .sb-toggle { position: absolute; right: -12px; top: 76px; width: 24px; height: 24px; background: var(--sb-bg); border: 1px solid var(--sb-line); border-radius: 50%; display: grid; place-items: center; color: var(--sb-ink-3); cursor: pointer; z-index: 2; transition: all 0.12s; } .sb-toggle:hover { border-color: var(--sb-accent); color: var(--sb-accent); } .sb-divider { height: 1px; background: var(--sb-line-2); margin: 10px 10px; } .sb-footer-btn { width: 100%; display: inline-flex; align-items: center; justify-content: center; gap: 8px; padding: 9px 10px; border-radius: 10px; font-size: 13px; font-weight: 600; cursor: pointer; font-family: inherit; transition: all 0.15s; border: 1px solid var(--sb-line); background: var(--sb-bg); color: var(--sb-ink); } .sb-footer-btn:hover { border-color: var(--sb-ink); background: var(--sb-bg-alt); } .sb-footer-btn.primary { background: var(--sb-accent); color: white; border-color: var(--sb-accent); } .sb-footer-btn.primary:hover { background: var(--sb-accent-2); border-color: var(--sb-accent-2); } .sb-social { display: inline-flex; align-items: center; justify-content: center; padding: 7px; border-radius: 8px; color: var(--sb-ink-3); transition: all 0.12s; } .sb-social:hover { background: var(--sb-bg-alt); color: var(--sb-accent); } .sb-user-email { font-family: 'JetBrains Mono', monospace; font-size: 11px; color: var(--sb-ink-3); margin-bottom: 10px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; } .sb-copyright { font-size: 11px; color: var(--sb-ink-3); text-align: center; margin-top: 10px; } </style><div class="sb fixed left-0 top-0 h-full flex flex-col transform transition-all duration-300 z-50 lg:translate-x-0 -translate-x-full w-64"><div class="flex items-center justify-between p-4" style="border-bottom:1px solid var(--sb-line)"><a href="https://vulntracker.io" class="sb-brand"><img src="/logo.png" alt="vulntracker.io"/><span>vulntracker<span class="accent">.io</span></span></a><button class="lg:hidden" style="background:transparent;border:none;color:var(--sb-ink-3);cursor:pointer;padding:4px;border-radius:6px"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-5 h-5"><path d="M18 6 6 18"></path><path d="m6 6 12 12"></path></svg></button></div><button class="hidden lg:flex sb-toggle" title="Collapse sidebar"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3.5 h-3.5"><path d="m15 18-6-6 6-6"></path></svg></button><nav class="flex-1 p-2 overflow-y-auto"><div style="margin-bottom:12px"><div class="sb-section-label">CVE Database</div><ul style="list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:2px"><li><button class="sb-item active "><div class="sb-item-left"><div style="position:relative"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="sb-item-icon w-4 h-4"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg></div><span>All CVEs</span></div></button></li><li><button class="sb-item "><div class="sb-item-left"><div style="position:relative"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="sb-item-icon w-4 h-4"><path d="M6 22V4a2 2 0 0 1 2-2h8a2 2 0 0 1 2 2v18Z"></path><path d="M6 12H4a2 2 0 0 0-2 2v6a2 2 0 0 0 2 2h2"></path><path d="M18 9h2a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2h-2"></path><path d="M10 6h4"></path><path d="M10 10h4"></path><path d="M10 14h4"></path><path d="M10 18h4"></path></svg></div><span>Vendors</span></div></button></li><li><button class="sb-item "><div class="sb-item-left"><div style="position:relative"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="sb-item-icon w-4 h-4"><path d="M16.5 9.4 7.55 4.24"></path><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><line x1="12" x2="12" y1="22" y2="12"></line></svg></div><span>Products</span></div></button></li></ul></div><div style="margin-bottom:12px"><div class="sb-section-label">Account</div><ul style="list-style:none;padding:0;margin:0;display:flex;flex-direction:column;gap:2px"><li><button class="sb-item "><div class="sb-item-left"><div style="position:relative"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="sb-item-icon w-4 h-4"><rect width="20" height="14" x="2" y="5" rx="2"></rect><line x1="2" x2="22" y1="10" y2="10"></line></svg></div><span>Pricing</span></div></button></li></ul></div><div style="margin-top:4px"><button class="sb-item "><div class="sb-item-left"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="sb-item-icon w-4 h-4"><path d="m3 21 1.9-5.7a8.5 8.5 0 1 1 3.8 3.8z"></path></svg><span>Feedback</span></div></button></div></nav><div class="p-3" style="border-top:1px solid var(--sb-line)"><button class="sb-footer-btn primary"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><path d="M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4"></path><polyline points="10 17 15 12 10 7"></polyline><line x1="15" x2="3" y1="12" y2="12"></line></svg><span>Sign in</span></button><div style="display:flex;justify-content:center;gap:4px;flex-direction:row;align-items:center;margin-top:10px"><a href="https://www.linkedin.com/company/vulntracker" target="_blank" rel="noopener noreferrer" class="sb-social" title="LinkedIn"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><path d="M16 8a6 6 0 0 1 6 6v7h-4v-7a2 2 0 0 0-2-2 2 2 0 0 0-2 2v7h-4v-7a6 6 0 0 1 6-6z"></path><rect width="4" height="12" x="2" y="9"></rect><circle cx="4" cy="4" r="2"></circle></svg></a><a href="https://x.com/vuln_tracker" target="_blank" rel="noopener noreferrer" class="sb-social" title="X (Twitter)"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><path d="M22 4s-.7 2.1-2 3.4c1.6 10-9.4 17.3-18 11.6 2.2.1 4.4-.6 6-2C3 15.5.5 9.6 3 5c2.2 2.6 5.6 4.1 9 4-.9-4.2 4-6.6 7-3.8 1.1 0 3-1.2 3-1.2z"></path></svg></a><a href="https://t.me/vulntracker" target="_blank" rel="noopener noreferrer" class="sb-social" title="Telegram"><svg class="w-4 h-4" viewBox="0 0 24 24" fill="currentColor"><path d="M11.944 0A12 12 0 0 0 0 12a12 12 0 0 0 12 12 12 12 0 0 0 12-12A12 12 0 0 0 12 0a12 12 0 0 0-.056 0zm4.962 7.224c.1-.002.321.023.465.14a.506.506 0 0 1 .171.325c.016.093.036.306.02.472-.18 1.898-.962 6.502-1.36 8.627-.168.9-.499 1.201-.82 1.23-.696.065-1.225-.46-1.9-.902-1.056-.693-1.653-1.124-2.678-1.8-1.185-.78-.417-1.21.258-1.91.177-.184 3.247-2.977 3.307-3.23.007-.032.014-.15-.056-.212s-.174-.041-.249-.024c-.106.024-1.793 1.14-5.061 3.345-.48.33-.913.49-1.302.48-.428-.008-1.252-.241-1.865-.44-.752-.245-1.349-.374-1.297-.789.027-.216.325-.437.893-.663 3.498-1.524 5.83-2.529 6.998-3.014 3.332-1.386 4.025-1.627 4.476-1.635z"></path></svg></a></div><div class="sb-copyright">© 2026 vulntracker.io</div></div></div><div class="flex-1 lg:ml-64"><header class="bg-white/80 backdrop-blur-lg border-b border-gray-100 sticky top-0 z-40 px-4 py-2 lg:hidden"><div class="flex items-center gap-4"><button class="lg:hidden p-2 rounded-xl hover:bg-gray-100 transition-colors duration-200 flex-shrink-0"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-5 h-5 text-gray-600"><line x1="4" x2="20" y1="12" y2="12"></line><line x1="4" x2="20" y1="6" y2="6"></line><line x1="4" x2="20" y1="18" y2="18"></line></svg></button><div class="flex items-center justify-between flex-1"><div></div></div></div></header><div class="w-full p-4 sm:p-6"><div class="mb-6"><div class="flex items-center justify-between mb-4"><button class="flex items-center text-brand-600 hover:text-brand-800"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 mr-2"><path d="m12 19-7-7 7-7"></path><path d="M19 12H5"></path></svg>Go Back</button></div><div class="bg-white rounded-xl shadow-lg p-4 sm:p-6 transition-all "><div class="flex flex-col sm:flex-row sm:items-start sm:justify-between mb-4 space-y-3 sm:space-y-0"><div class="flex items-center"><div><h1 class="text-xl sm:text-2xl font-bold text-gray-900 flex items-center flex-wrap"><span class="break-all">CVE-2022-1536</span><button class="ml-2 p-1 text-gray-400 hover:text-brand-600 transition-colors"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg></button></h1><p class="text-gray-600">automad Dashboard cross site scripting</p></div></div><div class="flex flex-col sm:flex-row sm:items-center space-y-2 sm:space-y-0 sm:space-x-3"><span class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[10px] font-bold uppercase tracking-wider border text-gray-700 bg-transparent border-gray-300 ">MEDIUM</span><div class="text-left sm:text-right"><div class="text-xl sm:text-2xl font-bold text-gray-700">5.4</div><div class="text-sm text-gray-400">CVSS Score</div></div></div></div><div class="grid grid-cols-1 sm:grid-cols-2 gap-3 sm:gap-4 text-sm"><div class="flex flex-col gap-2"><div class="flex items-center text-gray-600"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 mr-2 flex-shrink-0"><rect width="18" height="18" x="3" y="4" rx="2" ry="2"></rect><line x1="16" x2="16" y1="2" y2="6"></line><line x1="8" x2="8" y1="2" y2="6"></line><line x1="3" x2="21" y1="10" y2="10"></line></svg><span>Published: April 29, 2022 at 01:10 PM UTC</span></div><div class="flex items-center text-gray-600"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 mr-2 flex-shrink-0"><rect width="18" height="18" x="3" y="4" rx="2" ry="2"></rect><line x1="16" x2="16" y1="2" y2="6"></line><line x1="8" x2="8" y1="2" y2="6"></line><line x1="3" x2="21" y1="10" y2="10"></line></svg><span>Updated: June 17, 2026 at 04:22 AM UTC</span></div></div><div class="flex items-start text-gray-600 sm:col-span-2"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 mr-2 mt-0.5 flex-shrink-0"><path d="M16.5 9.4 7.55 4.24"></path><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><line x1="12" x2="12" y1="22" y2="12"></line></svg><div class="flex flex-wrap items-center gap-1.5"><span><strong class="text-gray-900">1</strong> product affected across 1 vendor</span><span class="inline-flex items-center px-2 py-0.5 text-xs font-medium bg-brand-50 text-brand-700 border border-brand-200 rounded-full">Automad</span></div></div></div></div><div class="mt-4 p-5 bg-gradient-to-r from-brand-50 to-indigo-50 border border-brand-200 rounded-xl"><div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4"><div class="flex-1"><div class="flex items-center mb-2"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-5 h-5 text-brand-600 mr-2"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg><h3 class="font-bold text-brand-900">Using automad by unspecified?</h3></div><p class="text-sm text-gray-600 mb-3">Get instant alerts when new vulnerabilities affect automad - before attackers find them.</p><div class="flex flex-wrap gap-x-4 gap-y-1 text-xs text-gray-500"><span class="flex items-center"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3 h-3 mr-1 text-green-500"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path><polyline points="22 4 12 14.01 9 11.01"></polyline></svg>Real-time alerts</span><span class="flex items-center"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3 h-3 mr-1 text-green-500"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path><polyline points="22 4 12 14.01 9 11.01"></polyline></svg>Track your software stack</span><span class="flex items-center"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3 h-3 mr-1 text-green-500"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path><polyline points="22 4 12 14.01 9 11.01"></polyline></svg>Free plan available</span></div></div><div class="flex flex-col sm:flex-row gap-2 sm:items-center"><a href="/register" class="inline-flex items-center justify-center px-5 py-2.5 bg-brand-700 text-white rounded-lg font-medium hover:bg-brand-800 transition-colors shadow-sm">Start Free<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 ml-2"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a href="/login" class="inline-flex items-center justify-center px-5 py-2.5 border border-gray-300 text-gray-700 rounded-lg font-medium hover:bg-gray-50 transition-colors">Sign In</a></div></div></div></div><div class="mt-4 grid grid-cols-2 gap-x-4 gap-y-4 rounded-xl border border-gray-200 bg-white px-4 py-3 shadow-sm sm:flex sm:flex-wrap sm:items-start sm:gap-x-6 sm:px-6"><div class="flex flex-col gap-1"><span class="font-mono text-[10px] uppercase tracking-wider text-gray-400 whitespace-nowrap">Severity</span><div class="flex flex-wrap items-center gap-1.5"><span class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[10px] font-bold uppercase tracking-wider border text-gray-700 bg-transparent border-gray-300 ">MEDIUM</span><span class="font-mono text-sm font-bold text-gray-700">5.4</span></div></div><div class="flex flex-col gap-1"><span class="font-mono text-[10px] uppercase tracking-wider text-gray-400 whitespace-nowrap">Exploit prediction</span><div class="flex flex-wrap items-center gap-1.5"><span class="inline-flex items-center rounded-md border px-2 py-0.5 text-xs font-semibold cursor-help bg-yellow-100 text-yellow-800 border-yellow-200 ">EPSS 0.7%</span></div></div><div class="flex flex-col gap-1"><span class="font-mono text-[10px] uppercase tracking-wider text-gray-400 whitespace-nowrap">SSVC</span><div class="flex flex-wrap items-center gap-1.5"><span class="inline-flex items-center rounded-md border px-2 py-0.5 text-xs font-semibold bg-gray-100 text-gray-600 border-gray-200 cursor-help">No known exploit</span></div></div></div><div class="mt-4 grid grid-cols-1 lg:grid-cols-3 gap-4 sm:gap-6 items-start"><div class="lg:col-span-2 space-y-4 sm:space-y-6"><div class="flex items-center gap-1 border-b border-gray-200"><button type="button" class="px-4 py-2.5 text-sm font-semibold border-b-2 -mb-px transition-colors border-brand-600 text-brand-700">Overview</button><button type="button" class="inline-flex items-center gap-1.5 px-4 py-2.5 text-sm font-semibold border-b-2 -mb-px transition-colors border-transparent text-gray-500 hover:text-gray-700"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><path d="M4 22h16a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2H8a2 2 0 0 0-2 2v16a2 2 0 0 1-2 2Zm0 0a2 2 0 0 1-2-2v-9c0-1.1.9-2 2-2h2"></path><path d="M18 14h-8"></path><path d="M15 18h-5"></path><path d="M10 6h8v4h-8V6Z"></path></svg>Newsroom</button><button type="button" class="inline-flex items-center gap-1.5 px-4 py-2.5 text-sm font-semibold border-b-2 -mb-px transition-colors border-transparent text-gray-500 hover:text-gray-700"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><path d="M10 2v7.527a2 2 0 0 1-.211.896L4.72 20.55a1 1 0 0 0 .9 1.45h12.76a1 1 0 0 0 .9-1.45l-5.069-10.127A2 2 0 0 1 14 9.527V2"></path><path d="M8.5 2h7"></path><path d="M7 16h10"></path></svg>Exploits</button><button type="button" class="inline-flex items-center gap-1.5 px-4 py-2.5 text-sm font-semibold border-b-2 -mb-px transition-colors border-transparent text-gray-500 hover:text-gray-700"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4"><circle cx="12" cy="12" r="10"></circle><polyline points="12 6 12 12 16 14"></polyline></svg>Timeline</button></div><div class="bg-white rounded-xl shadow-lg p-4 sm:p-6"><h2 class="text-lg font-semibold text-gray-900 mb-4 flex items-center"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-5 h-5 mr-2 text-brand-600"><path d="M14.5 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V7.5L14.5 2z"></path><polyline points="14 2 14 8 20 8"></polyline><line x1="16" x2="8" y1="13" y2="13"></line><line x1="16" x2="8" y1="17" y2="17"></line><line x1="10" x2="8" y1="9" y2="9"></line></svg>Description</h2><div class="space-y-4"><div class="inline-flex gap-0.5 rounded-lg bg-gray-100 p-0.5" role="tablist"><button type="button" role="tab" aria-selected="true" class="rounded-md px-2.5 py-1 font-mono text-[11px] font-bold uppercase tracking-wider transition-colors bg-white text-gray-900 shadow-sm">EN</button><button type="button" role="tab" aria-selected="false" class="rounded-md px-2.5 py-1 font-mono text-[11px] font-bold uppercase tracking-wider transition-colors text-gray-500 hover:text-gray-700">ES</button></div><p lang="en" class="max-w-[80ch] text-gray-800 leading-relaxed break-words whitespace-pre-wrap line-clamp-5">A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used.</p></div></div><div id="affected" class="scroll-mt-4"><div class="bg-white rounded-lg shadow border border-gray-200 overflow-hidden"><div class="px-4 sm:px-6 py-4 border-b border-gray-200"><div class="flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 text-brand-600"><path d="M16.5 9.4 7.55 4.24"></path><path d="M21 16V8a2 2 0 0 0-1-1.73l-7-4a2 2 0 0 0-2 0l-7 4A2 2 0 0 0 3 8v8a2 2 0 0 0 1 1.73l7 4a2 2 0 0 0 2 0l7-4A2 2 0 0 0 21 16z"></path><polyline points="3.29 7 12 12 20.71 7"></polyline><line x1="12" x2="12" y1="22" y2="12"></line></svg><h2 class="text-base sm:text-lg font-bold text-gray-900">Affected</h2></div></div><div role="tablist" class="flex flex-wrap border-b border-gray-200 bg-gray-50"><button type="button" role="tab" aria-selected="true" class="flex-1 min-w-[132px] text-left px-3 sm:px-4 py-2.5 border-b-2 transition-colors border-brand-600 text-brand-700 "><span class="flex items-center gap-1.5 flex-wrap"><img src="/images/sources/vtdb.webp" alt="" aria-hidden="true" class="h-3.5 w-auto shrink-0 transition-opacity opacity-100"/><span class="text-xs sm:text-sm font-semibold text-brand-700">VulnTracker VTDB</span><span class="font-mono text-[10px] px-1.5 py-0.5 rounded bg-brand-50 text-brand-700">1</span></span><span class="block text-[10px] text-gray-400 mt-0.5">our canonical data</span></button><button type="button" role="tab" aria-selected="false" class="flex-1 min-w-[132px] text-left px-3 sm:px-4 py-2.5 border-b-2 transition-colors border-transparent text-gray-500 hover:text-gray-700 "><span class="flex items-center gap-1.5 flex-wrap"><img src="/images/sources/mitre-cve.webp" alt="" aria-hidden="true" class="h-3.5 w-auto shrink-0 transition-opacity opacity-45"/><span class="text-xs sm:text-sm font-semibold ">MITRE · CNA</span><span class="font-mono text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-700">1</span></span><span class="block text-[10px] text-gray-400 mt-0.5">the vendor's own statement</span></button><button type="button" role="tab" aria-selected="false" class="flex-1 min-w-[132px] text-left px-3 sm:px-4 py-2.5 border-b-2 transition-colors border-transparent text-gray-500 hover:text-gray-700 "><span class="flex items-center gap-1.5 flex-wrap"><img src="/images/sources/nvd.webp" alt="" aria-hidden="true" class="h-3.5 w-auto shrink-0 transition-opacity opacity-45"/><span class="text-xs sm:text-sm font-semibold ">NVD · CPE</span><span class="font-mono text-[10px] px-1.5 py-0.5 rounded bg-gray-100 text-gray-700">1</span></span><span class="block text-[10px] text-gray-400 mt-0.5">scanner format</span></button></div><div role="tabpanel" class="px-4 sm:px-6 py-4"><p class="text-xs sm:text-sm text-gray-500 mb-2">Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.</p><div><div class=""><div class="border-b border-gray-100 last:border-b-0 py-2.5"><div class="flex items-start justify-between gap-3"><div class="min-w-0"><span class="flex items-center gap-1.5 flex-wrap"><a href="/products/automad-automad" class="font-semibold hover:underline text-gray-900" title="automad-automad">Automad</a><a href="/vendors/automad" class="text-xs text-gray-500 hover:underline">· Automad</a></span></div><span class="shrink-0 font-mono text-[11px] text-green-700 " title="95% confidence — matched on CPE identity">95%</span></div><div class="mt-1.5 flex flex-wrap gap-1.5"><span class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-red-50 text-red-700 border-red-200">v ≤ 1.10.9</span><a href="/versions/automad-automad-1-10-0" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.0">1.10.0</a><a href="/versions/automad-automad-1-10-1" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.1">1.10.1</a><a href="/versions/automad-automad-1-10-2" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.2">1.10.2</a><a href="/versions/automad-automad-1-10-3" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.3">1.10.3</a><a href="/versions/automad-automad-1-10-4" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.4">1.10.4</a><a href="/versions/automad-automad-1-10-5" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.5">1.10.5</a><a href="/versions/automad-automad-1-10-6" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.6">1.10.6</a><a href="/versions/automad-automad-1-10-7" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.7">1.10.7</a><a href="/versions/automad-automad-1-10-8" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.8">1.10.8</a><a href="/versions/automad-automad-1-10-9" class="inline-flex items-center px-2 py-0.5 rounded font-mono text-[11px] border bg-white text-brand-700 border-brand-200 hover:bg-brand-50 hover:border-brand-400 hover:underline" title="CVEs affecting 1.10.9">1.10.9</a></div></div></div></div></div></div></div><div id="remediation" class="bg-white rounded-xl shadow-lg p-4 sm:p-6"><div class="mb-1 flex flex-wrap items-center gap-2"><h2 class="flex items-center text-lg font-semibold text-gray-900"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="mr-2 h-5 w-5 text-brand-600"><path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"></path></svg>Remediation</h2><span class="inline-flex items-center rounded border border-gray-200 bg-gray-50 px-1.5 py-0.5 font-mono text-[10px] font-bold uppercase tracking-wider text-gray-500">No guide yet</span></div><p class="text-sm text-gray-500">No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.</p></div><div class="bg-white rounded-xl shadow-lg p-4 sm:p-6"><h2 class="text-lg font-semibold text-gray-900 mb-4 flex items-center"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-5 h-5 mr-2 text-brand-600"><path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path></svg>References (2)</h2><div class="space-y-3"><div class="p-3 border border-gray-200 rounded-lg hover:bg-gray-50 hover:border-blue-300 transition-colors"><div class="flex items-start justify-between gap-2"><div class="flex-1 min-w-0"><div class="flex flex-wrap gap-1.5 mb-2"><span class="inline-flex items-center px-2 py-0.5 rounded-md border text-[11px] font-semibold bg-gray-100 text-gray-600 border-gray-200">x_refsource_MISC</span></div><div class="text-sm text-gray-500 break-words mb-1">Source: cna@vuldb.com</div><a href="https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting%28XSS%29.md" target="_blank" rel="noopener noreferrer" class="text-sm text-brand-600 hover:text-brand-800 hover:underline break-all inline-flex items-center gap-1">https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting%28XSS%29.md<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3 h-3 flex-shrink-0"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path><polyline points="15 3 21 3 21 9"></polyline><line x1="10" x2="21" y1="14" y2="3"></line></svg></a></div></div></div><div class="p-3 border border-gray-200 rounded-lg hover:bg-gray-50 hover:border-blue-300 transition-colors"><div class="flex items-start justify-between gap-2"><div class="flex-1 min-w-0"><div class="flex flex-wrap gap-1.5 mb-2"><span class="inline-flex items-center px-2 py-0.5 rounded-md border text-[11px] font-semibold bg-gray-100 text-gray-600 border-gray-200">x_refsource_MISC</span><span class="inline-flex items-center px-2 py-0.5 rounded-md border text-[11px] font-semibold bg-gray-100 text-gray-600 border-gray-200">Third Party Advisory</span><span class="inline-flex items-center px-2 py-0.5 rounded-md border text-[11px] font-semibold bg-gray-100 text-gray-600 border-gray-200">VDB Entry</span></div><div class="text-sm text-gray-500 break-words mb-1">Source: cna@vuldb.com</div><a href="https://vuldb.com/?id.198706" target="_blank" rel="noopener noreferrer" class="text-sm text-brand-600 hover:text-brand-800 hover:underline break-all inline-flex items-center gap-1">https://vuldb.com/?id.198706<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3 h-3 flex-shrink-0"><path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path><polyline points="15 3 21 3 21 9"></polyline><line x1="10" x2="21" y1="14" y2="3"></line></svg></a></div></div></div></div></div></div><div class="space-y-4 sm:space-y-6 lg:sticky lg:top-4"><div class="bg-white rounded-xl shadow-lg border border-gray-100 p-4 sm:p-6"><h2 class="text-sm font-semibold text-gray-700 mb-3 flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 text-gray-500"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path><path d="M12 8v4"></path><path d="M12 16h.01"></path></svg>SSVC — Action Prioritization</h2><div class=""><div class="flex flex-wrap items-center gap-1.5"><span class="text-xs font-bold uppercase tracking-wide text-gray-400">SSVC</span><span class="inline-flex items-center rounded-md border px-2 py-0.5 text-xs font-semibold bg-gray-100 text-gray-600 border-gray-200" title="Exploitation status (SSVC): active = exploited in the wild, poc = proof-of-concept exists, none = no evidence">No known exploit</span><span class="inline-flex items-center rounded-md border px-2 py-0.5 text-xs font-semibold bg-gray-100 text-gray-600 border-gray-200" title="Can exploitation be automated / mass-exploited (worm-able)?">Not automatable</span><span class="inline-flex items-center rounded-md border px-2 py-0.5 text-xs font-semibold bg-gray-100 text-gray-600 border-gray-200" title="Impact of successful exploitation: total = full system control">Partial impact</span></div><p class="mt-2 text-xs text-gray-500">SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.</p></div></div><div class="bg-white rounded-xl shadow-lg p-4 sm:p-5"><h3 class="text-sm font-semibold text-gray-900 mb-3 flex items-center gap-2"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-4 h-4 text-brand-500"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path></svg>CVSS</h3><div class="flex flex-wrap gap-1 mb-3"><button type="button" class="px-2 py-0.5 rounded-md text-[11px] font-semibold border transition-colors bg-white text-gray-500 border-gray-200 hover:border-gray-300" title="VulDB">3.1 · VulDB</button><button type="button" class="px-2 py-0.5 rounded-md text-[11px] font-semibold border transition-colors bg-white text-gray-500 border-gray-200 hover:border-gray-300" title="cna@vuldb.com">3.1 · cna@vuldb.com</button><button type="button" class="px-2 py-0.5 rounded-md text-[11px] font-semibold border transition-colors bg-brand-50 text-brand-700 border-brand-200" title="nvd@nist.gov">3.1 · nvd@nist.gov</button><button type="button" class="px-2 py-0.5 rounded-md text-[11px] font-semibold border transition-colors bg-white text-gray-500 border-gray-200 hover:border-gray-300" title="nvd@nist.gov">2.0</button></div><div class="flex items-baseline gap-2 mb-3"><span class="text-xl font-bold text-gray-700">5.4</span><span class="text-[11px] font-semibold uppercase tracking-wide text-gray-500">MEDIUM</span><span class="ml-auto text-[10px] text-gray-400 truncate" title="nvd@nist.gov">nvd@nist.gov</span></div><dl class="grid grid-cols-2 gap-x-3 gap-y-2 mb-3"><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Attack Vector</dt><dd class="text-xs font-medium text-gray-800 break-words">NETWORK</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Complexity</dt><dd class="text-xs font-medium text-gray-800 break-words">LOW</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Privileges</dt><dd class="text-xs font-medium text-gray-800 break-words">LOW</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">User Interaction</dt><dd class="text-xs font-medium text-gray-800 break-words">REQUIRED</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Scope</dt><dd class="text-xs font-medium text-gray-800 break-words">CHANGED</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Confidentiality</dt><dd class="text-xs font-medium text-gray-800 break-words">LOW</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Integrity</dt><dd class="text-xs font-medium text-gray-800 break-words">LOW</dd></div><div class="min-w-0"><dt class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Availability</dt><dd class="text-xs font-medium text-gray-800 break-words">NONE</dd></div></dl><div class="flex items-center gap-1.5 pt-2 border-t border-gray-100"><span class="text-[10px] font-semibold uppercase tracking-wide text-gray-400">Vector</span><span class="inline-flex items-center justify-center w-3.5 h-3.5 rounded-full border border-current text-[9px] font-bold leading-none cursor-help normal-case opacity-70 hover:opacity-100 " aria-label="More info">?</span><button type="button" class="ml-auto p-1 text-gray-400 hover:text-brand-600 transition-colors" title="Copy vector string"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="w-3.5 h-3.5"><rect width="14" height="14" x="8" y="8" rx="2" ry="2"></rect><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"></path></svg></button></div></div><div class="bg-white rounded-xl shadow-lg p-4 sm:p-6"><h3 class="text-sm font-semibold text-gray-900 mb-3">Quick Info</h3><div class="space-y-2.5"><div class="flex justify-between items-center"><span class="text-xs text-gray-500">Status</span><span class="px-2 py-0.5 rounded-full text-[11px] font-medium bg-gray-100 text-gray-600">MODIFIED</span></div><div><span class="text-xs text-gray-500">CWE</span><div class="mt-1 flex flex-wrap gap-1"><span class="px-2 py-0.5 bg-blue-50 text-blue-700 rounded text-[11px] font-medium">CWE-79</span></div></div></div></div></div></div><div class="rounded-xl border border-gray-200 bg-white p-5 sm:p-6 mt-8"><p class="font-mono text-[10px] font-bold uppercase tracking-wider text-brand-600">Get alerted</p><div class="mt-2 flex flex-col gap-4 sm:flex-row sm:items-end sm:justify-between"><div class="max-w-xl"><h2 class="text-lg font-semibold text-gray-900">Stop reading CVE feeds looking for your own stack</h2><p class="mt-1 text-sm text-gray-600">Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.</p></div><div class="flex shrink-0 flex-col items-start gap-2 sm:items-end"><div class="flex flex-wrap gap-2"><a href="/register" class="inline-flex items-center gap-1.5 rounded-lg border border-brand-600 bg-brand-600 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-brand-700">Create account<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="h-4 w-4"><path d="M5 12h14"></path><path d="m12 5 7 7-7 7"></path></svg></a><a href="/login" class="inline-flex items-center rounded-lg border border-gray-300 px-4 py-2 text-sm font-semibold text-gray-700 transition-colors hover:bg-gray-50">Sign in</a></div><span class="text-xs text-gray-400">Free plan, no card</span></div></div></div></div></div></div><script src="/_next/static/chunks/webpack-03f7c6bc932ce1e3.js" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0]);self.__next_f.push([2,null])</script><script>self.__next_f.push([1,"1:HL[\"/_next/static/css/97d2e4afbb590ba2.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"2:I[2846,[],\"\"]\n5:I[4707,[],\"\"]\n7:I[6423,[],\"\"]\n8:I[9291,[\"185\",\"static/chunks/app/layout-fe5d21f6ad980dfc.js\"],\"default\"]\na:I[1060,[],\"\"]\n6:[\"id\",\"CVE-2022-1536\",\"d\"]\nb:[]\n"])</script><script>self.__next_f.push([1,"0:[\"$\",\"$L2\",null,{\"buildId\":\"9ZkYcLr7i2bn0eeILWwh3\",\"assetPrefix\":\"\",\"urlParts\":[\"\",\"cves\",\"CVE-2022-1536\"],\"initialTree\":[\"\",{\"children\":[\"cves\",{\"children\":[[\"id\",\"CVE-2022-1536\",\"d\"],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],\"initialSeedData\":[\"\",{\"children\":[\"cves\",{\"children\":[[\"id\",\"CVE-2022-1536\",\"d\"],{\"children\":[\"__PAGE__\",{},[[\"$L3\",\"$L4\",null],null],null]},[null,[\"$\",\"$L5\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\",\"cves\",\"children\",\"$6\",\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"notFoundStyles\":\"$undefined\"}]],null]},[null,[\"$\",\"$L5\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\",\"cves\",\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"notFoundStyles\":\"$undefined\"}]],null]},[[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/97d2e4afbb590ba2.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"link\",null,{\"rel\":\"preconnect\",\"href\":\"https://fonts.googleapis.com\"}],[\"$\",\"link\",null,{\"rel\":\"preconnect\",\"href\":\"https://fonts.gstatic.com\",\"crossOrigin\":\"\"}],[\"$\",\"link\",null,{\"href\":\"https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800\u0026family=JetBrains+Mono:wght@400;500;600\u0026family=Instrument+Serif\u0026display=swap\",\"rel\":\"stylesheet\"}]]}],[\"$\",\"body\",null,{\"children\":[[\"$\",\"$L8\",null,{}],[\"$\",\"$L5\",null,{\"parallelRouterKey\":\"children\",\"segmentPath\":[\"children\"],\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[\"$\",\"main\",null,{\"className\":\"wrap\",\"children\":[\"$\",\"div\",null,{\"className\":\"card\",\"children\":[[\"$\",\"h1\",null,{\"style\":{\"fontSize\":20,\"marginTop\":0},\"children\":\"No such CVE\"}],[\"$\",\"p\",null,{\"style\":{\"color\":\"var(--ink-3)\"},\"children\":\"There is no record with that identifier. It may have been withdrawn, or the identifier may be mistyped.\"}],[\"$\",\"p\",null,{\"children\":[\"$\",\"a\",null,{\"href\":\"/cves\",\"children\":\"Browse the CVE database\"}]}]]}]}],\"notFoundStyles\":[]}]]}]]}]],null],null],\"couldBeIntercepted\":false,\"initialHead\":[null,\"$L9\"],\"globalErrorComponent\":\"$a\",\"missingSlots\":\"$Wb\"}]\n"])</script><script>self.__next_f.push([1,"9:[[\"$\",\"meta\",\"0\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}],[\"$\",\"meta\",\"1\",{\"charSet\":\"utf-8\"}],[\"$\",\"title\",\"2\",{\"children\":\"CVE-2022-1536 — automad Dashboard cross site scripting | VulnTracker\"}],[\"$\",\"meta\",\"3\",{\"name\":\"description\",\"content\":\"A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home\u003c/title\u003e\u003cscript\u003ealert(\\\"home\\\")\u003c/script\u003e\u003ctitle\u003e leads to a cross site scripting. The attack can be initiated remotel\"}],[\"$\",\"meta\",\"4\",{\"name\":\"robots\",\"content\":\"index, follow\"}],[\"$\",\"link\",\"5\",{\"rel\":\"canonical\",\"href\":\"https://vulntracker.io/cves/CVE-2022-1536\"}],[\"$\",\"meta\",\"6\",{\"property\":\"og:title\",\"content\":\"CVE-2022-1536 — automad Dashboard cross site scripting\"}],[\"$\",\"meta\",\"7\",{\"property\":\"og:description\",\"content\":\"A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home\u003c/title\u003e\u003cscript\u003ealert(\\\"home\\\")\u003c/script\u003e\u003ctitle\u003e leads to a cross site scripting. The attack can be initiated remotel\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:url\",\"content\":\"https://vulntracker.io/cves/CVE-2022-1536\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:type\",\"content\":\"article\"}],[\"$\",\"meta\",\"10\",{\"name\":\"twitter:card\",\"content\":\"summary\"}],[\"$\",\"meta\",\"11\",{\"name\":\"twitter:title\",\"content\":\"CVE-2022-1536 — automad Dashboard cross site scripting\"}],[\"$\",\"meta\",\"12\",{\"name\":\"twitter:description\",\"content\":\"A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home\u003c/title\u003e\u003cscript\u003ealert(\\\"home\\\")\u003c/script\u003e\u003ctitle\u003e leads to a cross site scripting. The attack can be initiated remotel\"}]]\n3:null\n"])</script><script>self.__next_f.push([1,"c:I[1456,[\"862\",\"static/chunks/862-284cfc196e3926f0.js\",\"665\",\"static/chunks/665-a259dbd278cd2b27.js\",\"269\",\"static/chunks/app/cves/%5Bid%5D/page-62f12639b100d3ab.js\"],\"default\"]\n"])</script><script>self.__next_f.push([1,"4:[[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"{\\\"@context\\\":\\\"https://schema.org\\\",\\\"@type\\\":\\\"WebPage\\\",\\\"name\\\":\\\"CVE-2022-1536 — automad Dashboard cross site scripting\\\",\\\"url\\\":\\\"https://vulntracker.io/cves/CVE-2022-1536\\\",\\\"datePublished\\\":\\\"2022-04-29\\\",\\\"dateModified\\\":\\\"2026-06-17\\\",\\\"description\\\":\\\"A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home\u003c/title\u003e\u003cscript\u003ealert(\\\\\\\"home\\\\\\\")\u003c/script\u003e\u003ctitle\u003e leads to a cross site scripting. The attack can be initiated remotel\\\",\\\"mainEntity\\\":{\\\"@type\\\":\\\"Thing\\\",\\\"name\\\":\\\"CVE-2022-1536\\\",\\\"identifier\\\":\\\"CVE-2022-1536\\\",\\\"description\\\":\\\"automad Dashboard cross site scripting\\\"},\\\"isPartOf\\\":{\\\"@type\\\":\\\"WebSite\\\",\\\"name\\\":\\\"VulnTracker\\\",\\\"url\\\":\\\"https://vulntracker.io\\\"}}\"}}],[\"$\",\"$Lc\",null,{\"cveId\":\"CVE-2022-1536\",\"cve\":{\"cve_id\":\"CVE-2022-1536\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"vendor_name\":\"unspecified\",\"product_name\":\"automad\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"},\"product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"00000000-0000-0000-0000-000000000000\",\"name\":\"\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":0,\"is_active\":false,\"created_at\":\"0001-01-01T00:00:00Z\",\"updated_at\":\"0001-01-01T00:00:00Z\"}},\"products\":[{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}],\"affected_summary\":{\"product_count\":1,\"vendor_count\":1,\"platform_only_count\":0,\"top_products\":[\"Automad\"],\"source\":\"vtdb\"},\"affected_versions\":[{\"id\":\"1fecd10a-b939-48e2-a647-bf2864728acc\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.3\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.596725Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"d67cdc0a-0b93-4cf3-a9ab-f080f4620ac4\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.4\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.600838Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"46a5cf31-0039-4ad0-b773-4bfd261f431e\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.0\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.58442Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"695acfaf-f470-483d-9c49-231f9c8fb62c\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.8\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.617468Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"f2e8b19f-b085-4390-9a12-8eacc1ecb129\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.2\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.592926Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"8d9ebb1c-3586-4f0c-8a99-9630a1d79cb0\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.5\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.604863Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"a244f73b-0977-44c2-9bd2-f03eb69f0a8a\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.6\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.608791Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"87df62fe-b930-4b02-b958-ffb8f7651381\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.1\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.588488Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"a7458719-009b-40da-905f-2c510d5992b2\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.7\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.613088Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}},{\"id\":\"28ce33b0-379c-48df-9fed-2a5609da8e1c\",\"product_id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"version\":\"1.10.9\",\"cve_count\":1,\"created_at\":\"2025-09-16T23:16:21.621873Z\",\"Product\":{\"id\":\"e25e25a6-ae93-45c6-8264-f606efebb2d9\",\"name\":\"automad\",\"display_name\":\"\",\"vendor_id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"category\":\"\",\"description\":\"\",\"cve_count\":1,\"is_active\":true,\"created_at\":\"2025-09-16T23:16:21.582189Z\",\"updated_at\":\"2025-09-16T23:16:21.582189Z\",\"vendor\":{\"id\":\"987f8503-8d4f-4bb4-882c-2e8090e7ad05\",\"name\":\"unspecified\",\"display_name\":\"\",\"website\":\"\",\"description\":\"\",\"cve_count\":251,\"is_active\":true,\"created_at\":\"2025-09-16T22:29:28.169718Z\",\"updated_at\":\"2026-10-08T21:45:22.984098Z\"}}}],\"descriptions\":[{\"source\":\"nvd\",\"text\":\"A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home\u003c/title\u003e\u003cscript\u003ealert(\\\"home\\\")\u003c/script\u003e\u003ctitle\u003e leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used.\",\"lang\":\"en\"},{\"source\":\"nvd\",\"text\":\"Se ha encontrado una vulnerabilidad en automad versiones hasta 1.10.9 y ha sido clasificado como problemática. Esta vulnerabilidad afecta al Dashboard. La manipulación del argumento title con el input Home(/title)(script)alert(\\\"home\\\")(/script)(title) conlleva a un ataque de tipo cross site scripting. El ataque puede iniciarse de forma remota pero requiere una autenticación. Los detalles de la explotación han sido divulgados al público y pueden ser usados\",\"lang\":\"es\"}],\"reference_links\":[{\"source\":\"cna@vuldb.com\",\"text\":\"https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting%28XSS%29.md\",\"tags\":[\"x_refsource_MISC\"]},{\"source\":\"cna@vuldb.com\",\"text\":\"https://vuldb.com/?id.198706\",\"tags\":[\"x_refsource_MISC\",\"Third Party Advisory\",\"VDB Entry\"]}],\"cvss_metrics\":[{\"source\":\"cna\",\"provider\":\"VulDB\",\"version\":\"3.1\",\"base_score\":3.5,\"base_severity\":\"LOW\",\"vector_string\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N\",\"attack_vector\":\"NETWORK\",\"attack_complexity\":\"LOW\",\"privileges_required\":\"LOW\",\"user_interaction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentiality_impact\":\"NONE\",\"integrity_impact\":\"LOW\",\"availability_impact\":\"NONE\"},{\"source\":\"nvd\",\"provider\":\"cna@vuldb.com\",\"version\":\"3.1\",\"base_score\":3.5,\"base_severity\":\"LOW\",\"vector_string\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N\",\"attack_vector\":\"NETWORK\",\"attack_complexity\":\"LOW\",\"privileges_required\":\"LOW\",\"user_interaction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentiality_impact\":\"NONE\",\"integrity_impact\":\"LOW\",\"availability_impact\":\"NONE\"},{\"source\":\"nvd\",\"provider\":\"nvd@nist.gov\",\"version\":\"3.1\",\"base_score\":5.4,\"base_severity\":\"MEDIUM\",\"vector_string\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"attack_vector\":\"NETWORK\",\"attack_complexity\":\"LOW\",\"privileges_required\":\"LOW\",\"user_interaction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentiality_impact\":\"LOW\",\"integrity_impact\":\"LOW\",\"availability_impact\":\"NONE\"},{\"source\":\"nvd\",\"provider\":\"nvd@nist.gov\",\"version\":\"2.0\",\"base_score\":3.5,\"base_severity\":\"LOW\",\"vector_string\":\"AV:N/AC:M/Au:S/C:N/I:P/A:N\",\"confidentiality_impact\":\"NONE\",\"integrity_impact\":\"PARTIAL\",\"availability_impact\":\"NONE\"}],\"cwes\":[\"CWE-79\"],\"vulnerability_name\":\"automad Dashboard cross site scripting\",\"published_date\":\"2022-04-29T13:10:12Z\",\"source_modified_date\":\"2026-06-17T04:22:37.963Z\",\"base_score\":5.4,\"severity\":\"MEDIUM\",\"vuln_status\":\"MODIFIED\",\"is_tracked\":false,\"is_exploited\":false,\"epss_score\":0.00665,\"epss_percentile\":0.51669,\"ssvc\":{\"exploitation\":\"none\",\"automatable\":\"no\",\"technical_impact\":\"partial\",\"version\":\"2.0.3\"}},\"affected\":[{\"source\":\"vtdb\",\"priority\":1,\"title\":\"VulnTracker canonical\",\"description\":\"Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.\",\"count\":1,\"products\":[{\"id\":\"2a97037b-ebcb-4352-a4dd-e0e22a4112fd\",\"vendor_id\":\"f2da5433-0aec-45b2-a10b-55b20fdf55d3\",\"slug\":\"automad-automad\",\"display_name\":\"Automad\",\"vendor_slug\":\"automad\",\"vendor_name\":\"Automad\",\"type\":\"application\",\"ecosystem\":null,\"entry_kind\":\"affected\",\"versions\":[{\"id\":\"4d1fbf0f-8765-478f-9d05-4be77fd12a54\",\"slug\":\"automad-automad-1-10-0\",\"version\":\"1.10.0\"},{\"id\":\"21f52de2-f672-4336-99f5-4bb22b91e08c\",\"slug\":\"automad-automad-1-10-1\",\"version\":\"1.10.1\"},{\"id\":\"7608a2c5-2d68-4efe-8999-f20355392043\",\"slug\":\"automad-automad-1-10-2\",\"version\":\"1.10.2\"},{\"id\":\"6293ffe9-825f-48ce-9cbd-8e8f86aa117b\",\"slug\":\"automad-automad-1-10-3\",\"version\":\"1.10.3\"},{\"id\":\"4121a3c9-3864-4178-9e55-f8fe825d98d9\",\"slug\":\"automad-automad-1-10-4\",\"version\":\"1.10.4\"},{\"id\":\"27ee03a2-24f5-46dc-a2c8-fe651d4f1839\",\"slug\":\"automad-automad-1-10-5\",\"version\":\"1.10.5\"},{\"id\":\"cd50d8aa-c5cb-4c2f-96bf-9ba8ff5c2401\",\"slug\":\"automad-automad-1-10-6\",\"version\":\"1.10.6\"},{\"id\":\"14df68da-6e30-4096-8c39-754054e09d6c\",\"slug\":\"automad-automad-1-10-7\",\"version\":\"1.10.7\"},{\"id\":\"453dff20-a581-4a7f-b9f9-c95f4488f3a5\",\"slug\":\"automad-automad-1-10-8\",\"version\":\"1.10.8\"},{\"id\":\"428bd77c-1123-445d-9834-6421fe12dd25\",\"slug\":\"automad-automad-1-10-9\",\"version\":\"1.10.9\"}],\"ranges\":[{\"bitis_dahil\":\"1.10.9\"}],\"range_count\":1,\"all_versions\":false,\"version_scheme\":null,\"confidence\":0.949999988079071,\"evidence_kinds\":null,\"fixes\":null,\"platforms\":null}]},{\"source\":\"mitre\",\"priority\":2,\"title\":\"Reported by the CNA\",\"description\":\"The vendor's own words, unprocessed. Free text — spelling differences and corporate suffixes live here.\",\"count\":1,\"products\":[{\"vendor\":\"unspecified\",\"product\":\"automad\",\"package_name\":null,\"collection_url\":null,\"repo\":null,\"default_status\":null,\"versions\":[{\"status\":\"affected\",\"version\":\"1.10.0\"},{\"status\":\"affected\",\"version\":\"1.10.1\"},{\"status\":\"affected\",\"version\":\"1.10.2\"},{\"status\":\"affected\",\"version\":\"1.10.3\"},{\"status\":\"affected\",\"version\":\"1.10.4\"},{\"status\":\"affected\",\"version\":\"1.10.5\"},{\"status\":\"affected\",\"version\":\"1.10.6\"},{\"status\":\"affected\",\"version\":\"1.10.7\"},{\"status\":\"affected\",\"version\":\"1.10.8\"},{\"status\":\"affected\",\"version\":\"1.10.9\"}],\"platforms\":null}]},{\"source\":\"nvd\",\"priority\":3,\"title\":\"NVD CPE\",\"description\":\"Machine-readable CPE rows for scanner matching. A row with vulnerable=false names the platform the affected product runs on, not an affected product.\",\"count\":1,\"products\":[{\"full_cpe\":\"cpe:2.3:a:automad:automad:*:*:*:*:*:*:*:*\",\"part\":\"a\",\"vendor\":\"automad\",\"product\":\"automad\",\"version\":\"*\",\"version_start_including\":\"\",\"version_start_excluding\":\"\",\"version_end_including\":\"1.10.9\",\"version_end_excluding\":\"\",\"vulnerable\":true}]}],\"tab\":\"overview\",\"articles\":null,\"exploits\":null}]]\n"])</script></body></html>