CVE-2022-3895: Hallowelt Bluespice

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).

Affected products

• Hallowelt Bluespice: from 4.1.0, before 4.2.1 (fixed in 4.2.1)
• Hallowelt Common User Interface: from 3.0.0, before 3.0.5 (fixed in 3.0.5)

Published 2022-11-15. Last modified 2026-06-17.