Read the docs
TI-2022-23938 Aliases CVE-2022-48324GHSA-7844-j976-mqjq

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to…

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa, (2) data, (3) data2, (4) nome, (5) descricao, (6) idDocumentos, (7) id in file application/controllers/Arquivos.php; (8) senha, (9) nomeCliente, (10) contato, (11) documento, (12) telefone, (13) celular, (14) email, (15) rua, (16) numero, (17) complemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clientes.php; (24) id, (25) tipo, (26) forma_pagamento, (27) gateway_de_pagamento, (28) excluir_id, (29) confirma_id, (30) cancela_id in file application/controllers/Cobrancas.php; (31) vencimento_de, (32) vencimento_ate, (33) cliente, (34) tipo, (35) status, (36) valor_desconto, (37) desconto, (38) periodo, (39) per_page, (40) urlAtual, (41) vencimento, (42) recebimento, (43) valor, (44) recebido, (45) formaPgto, (46) desconto_parc, (47) entrada, (48) qtdparcelas_parc, (49) valor_parc, (50) dia_pgto, (51) dia_base_pgto, (52) comissao, (53) descricao_parc, (54) cliente_parc, (55) observacoes_parc, (56) formaPgto_parc, (57) tipo_parc, (58) pagamento, (59) pago, (60) valor_desconto_editar, (61) descricao, (62) fornecedor, (63) observacoes, (64) id in file application/controllers/Financeiro.php; (65) refGarantia, (66) textoGarantia, (67) idGarantias in file application/controllers/Garantias.php; (68) email, (69) senha in file application/controllers/Login.php.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00628 50th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mapos:map-os:4.39.0:*:*:*:*:*:*:*4.39.0VulnerableMapos
  • cpe:2.3:a:mapos:map-os:4.39.0:*:*:*:*:*:*:* Versions 4.39.0 Vulnerable ·Mapos

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-48324
  2. 2026-10-03 Alias added: GHSA-7844-j976-mqjq
  3. 2026-10-29 EPSS moved to the 50th–90th percentile

References

Exploit 2

Patch 1

  • TI-2022-23941 Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2022-23940 Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2022-23939 Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2024-23464 MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability. CVSS 3.1MEDIUM 6.1
  • TI-2024-24414 MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences