CVE

CVE-2022-42746

6.1

CVSSmedium

Exploitable remotely over the internet · no authentication required · user interaction needed.

Description

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

Attack Vector

Network

Privileges Req.

None

User Interaction

Required

candidats

Updated Sep 22, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2022-42746 Scanner

CVE-2022-42746 scanner - Cross-Site Scripting (XSS) vulnerability in CandidATS

Used 2.4k times · 5.9k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →