PatchTheCVECVE-2022-4930: A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4
CVE-2022-4930 is a low-severity flaw (CVSS 3.5) affecting syspass. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an unknown functionality of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.5 is able to address this issue. The patch is named 4da4d031732ecca67519851fd0c34597dbb8ee55. It is recommended to upgrade the affected component. The associated ident
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.5 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.5% (top 56%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-03-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-4930?
syspass: upgrade to newer than 3.2.4. Exact commands for each OS are on this page.
Is CVE-2022-4930 being exploited?
CVE-2022-4930 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-4930 affect?
CVE-2022-4930 affects syspass. Severity is low (CVSS 3.5). A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an unknown functionality of the component URL Handler. The manipulation leads to cross site scripting. The attack can be l
How urgent is CVE-2022-4930?
Priority 23/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-25478 MEDIUM 6.5 UPGRADE The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filename
- CVE-2025-25477 HIGH 8.1 UPGRADE A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an ar
- CVE-2025-25476 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privi
- CVE-2024-42904 MEDIUM 6.1 UPGRADE A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts
- CVE-2017-9306 MEDIUM 6.1 DOWNGRADE inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated