Read the docs
TI-2022-17793 Aliases CVE-2022-38080GHSA-8629-83m5-rj75

Cross-site scripting in Kajitori Co.,Ltd Exment

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.

Why it matters now

EPSS 0.00933 60th percentileScored 2026-11-07
Fix Fixed exceedone/exment (Packagist): 5.0.3, 4.4.3exceedone/laravel-admin (Packagist): 2.2.3, 3.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Kajitori Co.,LtdExment(PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier—No fix listedCNA
—exceedone/exment (Packagist)5.0.0 to before 5.0.35.0.3Patch availableGHSA-8629-83m5-rj75
—exceedone/exment (Packagist)before 4.4.34.4.3Patch availableGHSA-8629-83m5-rj75
—exceedone/laravel-admin (Packagist)before 2.2.32.2.3Patch availableGHSA-8629-83m5-rj75
—exceedone/laravel-admin (Packagist)3.0.0 to before 3.0.13.0.1Patch availableGHSA-8629-83m5-rj75
  • Exment VendorKajitori Co.,Ltd Affected (PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier Fixed in — No fix listed CNA
  • exceedone/exment (Packagist) Vendor— Affected 5.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-8629-83m5-rj75
  • exceedone/exment (Packagist) Vendor— Affected before 4.4.3 Fixed in 4.4.3 Patch available GHSA-8629-83m5-rj75
  • exceedone/laravel-admin (Packagist) Vendor— Affected before 2.2.3 Fixed in 2.2.3 Patch available GHSA-8629-83m5-rj75
  • exceedone/laravel-admin (Packagist) Vendor— Affected 3.0.0 to before 3.0.1 Fixed in 3.0.1 Patch available GHSA-8629-83m5-rj75

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:exceedone:exment:*:*:*:*:*:*:*:*up to 5.0.2VulnerableKajitori Co.,Ltd
cpe:2.3:a:exceedone:laravel-admin:*:*:*:*:*:*:*:*up to 3.0.1VulnerableKajitori Co.,Ltd
  • cpe:2.3:a:exceedone:exment:*:*:*:*:*:*:*:* Versions up to 5.0.2 Vulnerable ·Kajitori Co.,Ltd
  • cpe:2.3:a:exceedone:laravel-admin:*:*:*:*:*:*:*:* Versions up to 3.0.1 Vulnerable ·Kajitori Co.,Ltd

Remediation

  • Fix · GHSA-8629-83m5-rj75 exceedone/exment (Packagist) Fixed in 5.0.3 Advisory →
  • Fix · GHSA-8629-83m5-rj75 exceedone/exment (Packagist) Fixed in 4.4.3 Advisory →
  • Fix · GHSA-8629-83m5-rj75 exceedone/laravel-admin (Packagist) Fixed in 2.2.3 Advisory →
  • Fix · GHSA-8629-83m5-rj75 exceedone/laravel-admin (Packagist) Fixed in 3.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38080
  2. 2026-10-03 Alias added: GHSA-8629-83m5-rj75

References

Patch 2

Advisory 2

Other 1

  • TI-2022-17407 SQL injection in Kajitori Co.,Ltd Exment CVSS 3.1HIGH 8.8
  • TI-2022-17800 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2020-04587 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2020-04588 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2024-32063 Cross-site scripting in Kajitori Co.,Ltd Exment CVSS 3.1MEDIUM 5.4
  • TI-2024-31309 Incorrect permission assignment in Kajitori Co.,Ltd Exment CVSS 3.1LOW 3.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences