← All advisories

Critical severity9.0NVD Advisory· Published Oct 11, 2022· Updated Jun 17, 2026

CVE-2022-32174

CVE-2022-32174

Description

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
gogs.io/gogsGo	>= 0.6.5, <= 0.12.10	—

Affected products

3

Gogs/Gogsv52 versions
v0.6.5+ 1 more
- (no CPE)range: v0.6.5
- cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*range: >=0.6.5,<=0.12.10
ghsa-coords
pkg:golang/gogs.io/gogs
Range: >= 0.6.5, <= 0.12.10

Patches

Vulnerability mechanics

References

5

github.com/gogs/gogs/blob/v0.12.10/public/js/gogs.jsnvdExploitThird Party AdvisoryWEB
www.mend.io/vulnerability-database/CVE-2022-32174nvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-mcjj-2fvq-mc3rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-32174ghsaADVISORY
pkg.go.dev/vuln/GO-2022-1060ghsaWEB

News mentions

0

No linked articles in our index yet.