CVE-2022-27107

OrangeHRM 4.10 contains a Stored XSS vulnerability in the 3Share Video3 feature under OrangeBuzz, exploitable via the GET/POST parameter createVideo[linkAddress]. The CVE notes this can allow JavaScript execution in the context of an affected user. CVSS metrics report MEDIUM severity (3.1) wi...