{"id":"CVE-2022-23543","aliases":["EUVD-2022-28561"],"status":"published","title":"HTML attributes when attaching a YouTube link to the post","description":"Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `\u003ciframe\u003e` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert(\"xss\")`) to the `\u003ciframe\u003e'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00356,"percentile":0.29603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79","CWE-80"],"published":"2022-12-19T21:30:09Z","modified":"2026-06-17T04:30:19Z","products":[{"vendor":"mesosoi","product":"silverwaregames-io-issue-tracker"},{"vendor":"silverwaregames","product":"silverwaregames"}],"references":[{"url":"https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-62r9-4v3r-rw89","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]}],"sources":{"cve":[{"id":"CVE-2022-23543","title":"HTML attributes when attaching a YouTube link to the post","description":"Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `\u003ciframe\u003e` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert(\"xss\")`) to the `\u003ciframe\u003e'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.","status":"published","published":"2022-12-19T21:30:09.836Z","modified":"2025-04-15T19:01:44.429Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-80"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-28561","description":"Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `\u003ciframe\u003e` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert(\"xss\")`) to the `\u003ciframe\u003e'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.","status":"published","published":"2022-12-19T21:30:09Z","modified":"2025-04-15T19:01:44Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:26.772603Z"}],"nvd":[{"id":"CVE-2022-23543","description":"Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `\u003ciframe\u003e` when the post will be published. The handler has some sort of protection so non-YouTube links can't be posted, as well as HTML tags are being stripped. However, it was still possible to add custom HTML attributes (e.g. `onclick=alert(\"xss\")`) to the `\u003ciframe\u003e'. This issue was fixed in the version `1.1.34` and does not require any extra actions from our members. There has been no evidence that this vulnerability was used by anyone at this time.","status":"published","published":"2022-12-19T22:15:10.92Z","modified":"2026-06-17T04:30:19.637Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-80","CWE-79"],"updated_at":"2026-11-02T14:07:34.031641Z"}]}}