CVE-2022-40849: Thinkcmf

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).

Affected products

• Thinkcmf Thinkcmf: version 6.0.7 only

Published 2022-12-01. Last modified 2026-06-17.