Persistent XSS in DHC Vision eQMS Product by DHC

CVE-2022-24957

What is CVE-2022-24957?

DHC Vision eQMS versions up to 5.4.8.322 are susceptible to a Persistent Cross-Site Scripting (XSS) vulnerability stemming from inadequate encoding of untrusted inputs. An attacker can exploit this by creating or modifying an information object and embedding an XSS payload within its name. When another user accesses the object's version or history, the malicious script executes, potentially compromising sensitive data. This vulnerability highlights the critical need for robust input validation and output encoding practices to safeguard against unauthorized script execution.

References