{"id":"CVE-2022-2035","aliases":["EUVD-2022-34339","GHSA-hhxf-mm6p-f8cq"],"status":"published","title":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the...","description":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions \u003c 20.1.45.914, 21.1.x \u003c 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00754,"percentile":0.55366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2022-06-09T14:23:25Z","modified":"2026-06-17T04:41:10Z","products":[{"vendor":"ltgplc","product":"rustici_software_scorm_engine"}],"references":[{"url":"https://www.tenable.com/security/research/tra-2022-21","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2035"},{"url":"https://github.com/advisories/GHSA-hhxf-mm6p-f8cq"}],"sources":{"cve":[{"id":"CVE-2022-2035","description":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions \u003c 20.1.45.914, 21.1.x \u003c 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.","status":"published","published":"2022-06-09T14:23:25Z","modified":"2024-08-03T00:24:44.069Z","updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2022-34339","description":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions \u003c 20.1.45.914, 21.1.x \u003c 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.","status":"published","published":"2022-06-09T14:23:25Z","modified":"2024-08-03T00:24:44Z","updated_at":"2026-11-03T03:25:59.498764Z"}],"ghsa":[{"id":"GHSA-hhxf-mm6p-f8cq","title":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the...","description":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions \u003c 20.1.45.914, 21.1.x \u003c 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.","status":"published","published":"2022-06-10T00:00:56Z","modified":"2023-01-27T05:03:29Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:15.225524Z"}],"nvd":[{"id":"CVE-2022-2035","description":"A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions \u003c 20.1.45.914, 21.1.x \u003c 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.","status":"published","published":"2022-06-09T15:15:09.743Z","modified":"2026-06-17T04:41:10.26Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:21.62951Z"}]}}