CVE

CVE-2022-26159

5.3

CVSS

Description

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.

Attack Vector

Privileges Req.

User Interaction

Updated Sep 22, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2022-26159 Scanner

CVE-2022-26159 scanner - Information Disclosure vulnerability in Auto-Completion plugin for Ametys CMS

Used 3.3k times · 5.9k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →