{"id":"CVE-2022-0960","aliases":["EUVD-2022-1535","GHSA-rphc-h572-2x9f"],"status":"published","title":"Stored XSS viva .properties file upload in star7th/showdoc","description":"Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.","severity":{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00853,"percentile":0.58715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434","CWE-79"],"published":"2022-03-14T14:45:13Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Packagist","package":"showdoc/showdoc","fixed_in":["2.10.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"showdoc/showdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"showdoc/showdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.4"}]}],"versions":["v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.1.0","v1.1.1","v1.1.3","v1.1.4","v1.1.5","v1.2.0","v1.2.1","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.3.0","v1.3.1","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.3.7","v1.3.8","v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.4.6","v1.4.7","v1.5.0","v1.5.1","v1.5.2","v1.5.3","v1.6.0","v1.6.1","v1.6.2","v1.7.0","v1.7.1","v1.7.2","v1.8.0","v1.8.1","v1.8.2","v1.8.3","v1.8.4","v1.8.5","v1.8.6","v2.0","v2.0.1","v2.0.10","v2.0.2","v2.0.3","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.0.9","v2.1.0","v2.1.1","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.10.0","v2.10.1","v2.10.2","v2.10.3","v2.2.0","v2.2.1","v2.3.0","v2.3.1","v2.3.3","v2.4.0","v2.4.1","v2.4.10","v2.4.11","v2.4.12","v2.4.13","v2.4.15","v2.4.16","v2.4.17","v2.4.2","v2.4.3","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.1","v2.5.2","v2.5.3","v2.5.5","v2.6.1","v2.6.2","v2.6.3","v2.6.5","v2.6.6","v2.6.7","v2.7.0","v2.7.1","v2.8.0","v2.8.1","v2.8.10","v2.8.11","v2.8.12","v2.8.13","v2.8.14","v2.8.15","v2.8.16","v2.8.2","v2.8.3","v2.8.5","v2.8.6","v2.8.7","v2.8.8","v2.8.9","v2.9.0","v2.9.1","v2.9.10","v2.9.11","v2.9.12","v2.9.13","v2.9.14","v2.9.15","v2.9.2","v2.9.3","v2.9.4","v2.9.5","v2.9.6","v2.9.7","v2.9.8","v2.9.9"]}],"products":[{"vendor":"showdoc","product":"showdoc"},{"vendor":"star7th","product":"star7th/showdoc"}],"references":[{"url":"https://huntr.dev/bounties/462cd8a7-b1a9-4e93-af71-b56ba1d7ad4e","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://github.com/star7th/showdoc/commit/92bc6a83a3a60e01a0d2effb98ab47d8d7eab28f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0960","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rphc-h572-2x9f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0960.json","tags":["advisory"]},{"url":"https://github.com/star7th/showdoc","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-0960","title":"Stored XSS viva .properties file upload in star7th/showdoc","description":"Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.","status":"published","published":"2022-03-14T14:45:13Z","modified":"2024-08-02T23:47:42.832Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-1535","description":"Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.","status":"published","published":"2022-03-14T14:45:13Z","modified":"2024-08-02T23:47:42Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:26:03.474849Z"}],"ghsa":[{"id":"GHSA-rphc-h572-2x9f","title":"Cross-site Scripting in showdoc/showdoc","description":"ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.","status":"published","published":"2022-03-15T00:00:55Z","modified":"2023-01-27T05:00:42Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:36:14.825433Z"}],"nvd":[{"id":"CVE-2022-0960","description":"Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.","status":"published","published":"2022-03-14T15:15:10.707Z","modified":"2026-06-17T04:21:33.28Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T14:07:13.7085Z"}],"osv":[{"id":"CVE-2022-0960","title":"Stored XSS viva .properties file upload in star7th/showdoc","description":"Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.","status":"published","published":"2022-03-14T14:45:13Z","modified":"2026-10-28T02:30:40.934499627Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"GHSA-rphc-h572-2x9f","title":"Cross-site Scripting in showdoc/showdoc","description":"ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.","status":"published","published":"2022-03-15T00:00:55Z","modified":"2023-11-08T04:07:43.796458Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T15:46:56.281047Z"}]}}