Medium severity5.4NVD Advisory· Published Aug 24, 2022· Updated Jun 17, 2026

CVE-2022-38089

Description

Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

exceedone/exmentllm-create
Range: <=5.0.2, <=4.4.2
exceedone/laravel-adminllm-fuzzy
Range: <=3.0.0, <=2.2.2
Kajitori Co.,Ltd/Exmentv5
Range: (PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier

Patches

Vulnerability mechanics

References

exment.net/docs/nvdPatchRelease NotesVendor Advisory
exment.net/docs/nvdMitigationPatchVendor Advisory
jvn.jp/en/jp/JVN46239102/index.htmlnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000