CVE-2022-45326: Kwoksys Information Server

Medium severity, CVSS 4.9. EPSS: 1.2% chance of exploitation in the next 30 days.

An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks.

Affected products

• Kwoksys Information Server: before 2.9.5 (fixed in 2.9.5); version 2.9.5 only

Published 2022-12-06. Last modified 2026-06-17.