CVE-2022-38089: Exceedone Exment

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.

Affected products

• Exceedone Exment: up to and including 5.0.2
• Exceedone Laravel-Admin: up to and including 3.0.0

Published 2022-08-24. Last modified 2026-06-17.