Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-36433 — Cross-site Scripting (XSS) in blog-post creation functionality in Amasty Blog Pro for Magento 2 | Kitploit
Tools/GitHubGitHub/afine-com/cve-2022-36433
Vulnerability AnalysisWeb Application ExploitationWeb SecurityPenetration TestingLearning & Education
GitHubafine-com/cve-2022-36433

CVE-2022-36433

Cross-site Scripting (XSS) in blog-post creation functionality in Amasty Blog Pro for Magento 2

View Repository
113 years agoNot yet reviewed
Website

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-36433

Cross-site Scripting (XSS) in blog-post creation functionality in Amasty Blog Pro for Magento 2

Description

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.

Vulnerable endpoints which are the injection points for the parameters mentioned above:

  • POST /admin/amasty_blog/posts/preview/key/{some_key}/?isAjax=true
  • POST /admin/amasty_blog/posts/save/key/{some_key}/back/edit

Affected versions

< 2.10.5

Advisory

Update Amasty Blog Pro for Magento 2 to 2.10.5 or newer.

References

  • https://amasty.com/blog-pro-for-magento-2.html
Download Tool