Read the docs
TI-2022-23940 Aliases CVE-2022-48326GHSA-ch7m-946x-3x9p

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to…

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2) aCliente, (3) eCliente, (4) dCliente, (5) vCliente, (6) aProduto, (7) eProduto, (8) dProduto, (9) vProduto, (10) aServico, (11) eServico, (12) dServico, (13) vServico, (14) aOs, (15) eOs, (16) dOs, (17) vOs, (18) aVenda, (19) eVenda, (20) dVenda, (21) vVenda, (22) aGarantia, (23) eGarantia, (24) dGarantia, (25) vGarantia, (26) aArquivo, (27) eArquivo, (28) dArquivo, (29) vArquivo, (30) aPagamento, (31) ePagamento, (32) dPagamento, (33) vPagamento, (34) aLancamento, (35) eLancamento, (36) dLancamento, (37) vLancamento, (38) cUsuario, (39) cEmitente, (40) cPermissao, (41) cBackup, (42) cAuditoria, (43) cEmail, (44) cSistema, (45) rCliente, (46) rProduto, (47) rServico, (48) rOs, (49) rVenda, (50) rFinanceiro, (51) aCobranca, (52) eCobranca, (53) dCobranca, (54) vCobranca, (55) situacao, (56) idPermissao, (57) id in file application/controllers/Permissoes.php; (58) precoCompra, (59) precoVenda, (60) descricao, (61) unidade, (62) estoque, (63) estoqueMinimo, (64) idProdutos, (65) id, (66) estoqueAtual in file application/controllers/Produtos.php.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00645 51st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mapos:map-os:4.39.0:*:*:*:*:*:*:*4.39.0VulnerableMapos
  • cpe:2.3:a:mapos:map-os:4.39.0:*:*:*:*:*:*:* Versions 4.39.0 Vulnerable ·Mapos

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-48326
  2. 2026-10-03 Alias added: GHSA-ch7m-946x-3x9p
  3. 2026-10-20 EPSS moved to the 50th–90th percentile

References

Exploit 2

Patch 1

  • TI-2022-23941 Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2022-23939 Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2022-23938 Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to… CVSS 3.1MEDIUM 6.1
  • TI-2024-23464 MAP-OS v4.45.0 and earlier was discovered to contain a cross-site scripting (XSS) vulnerability. CVSS 3.1MEDIUM 6.1
  • TI-2024-24414 MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting (XSS). CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences