By combining AI with human insight, Armis Vulnerability Intelligence Database offers extended coverage for vulnerabilities that matter to you, your industry, and provides you with clear remediation instructions.
Loading CVE list…
CVE Name
Severity Score
Published Date
CISA KEV
Take These Insights to the Next Level
Armis now offers direct API access to Armis Vulnerability Intelligence Database through the AWS Marketplace, transforming it from a powerful research tool into an integrated component of your proactive security posture.
Seamless Integration: Directly feed Armis's contextual data into your existing stack.
Automated Workflows: Automate vulnerability lookups in real-time.
Custom Solutions: Use the raw data to build custom dashboards, reports, alerts.
See everything.Identify true risk.Proactively mitigate threats.Book a Demo
Let's talk!
CVE-2022-2956:
Loading CVE details…
CVE-2022-2956 | Medium Severity | Armis
), and exploitation requires user interaction; CVSS v3.1 base score 3.5 (Low).\n","articleBody":"Cross-site scripting (XSS) vulnerability in ConsoleTVs Noxen via the create_user_username parameter in /Noxen-master/users.php. An attacker can remotely inject a script payload (for example, >), and exploitation requires user interaction; CVSS v3.1 base score 3.5 (Low).\n\n\nConsoleTVs Noxen contains a cross-site scripting vulnerability in the users.php component that reflects unsanitized input from the create_user_username parameter. An attacker can exploit this remotely by supplying a crafted payload such as >, and the exploitation requires user interaction. The vulnerability is assigned CVSS v3.1 base score 3.5 (Low), with low integrity impact and no confidentiality or availability impact.\n","datePublished":"2022-08-23T11:15:08.000Z","dateModified":"2026-05-13T09:08:51.762Z","keywords":"Medium, 2022, CVE, vulnerability, cybersecurity, CVSS","url":"https://cve.armis.com/CVE-2022-2956","author":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"publisher":{"@type":"Organization","name":"Armis","url":"https://www.armis.com"},"license":"https://creativecommons.org/licenses/by-nc-sa/4.0/","isBasedOn":{"@type":"WebPage","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2956","name":"NVD CVE-2022-2956"},"additionalProperty":[{"@type":"PropertyValue","name":"CVSS Score","value":"6.1"},{"@type":"PropertyValue","name":"Severity","value":"Medium"},{"@type":"PropertyValue","name":"EPSS Score","value":"0.22%"},{"@type":"PropertyValue","name":"EPSS Percentile","value":"45th"},{"@type":"PropertyValue","name":"Attack Vector","value":"NETWORK"},{"@type":"PropertyValue","name":"Attack Complexity","value":"LOW"},{"@type":"PropertyValue","name":"Privileges Required","value":"NONE"},{"@type":"PropertyValue","name":"User Interaction","value":"REQUIRED"},{"@type":"PropertyValue","name":"Scope","value":"CHANGED"},{"@type":"PropertyValue","name":"Confidentiality Impact","value":"LOW"},{"@type":"PropertyValue","name":"Integrity Impact","value":"LOW"},{"@type":"PropertyValue","name":"Availability Impact","value":"NONE"}]},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is CVE-2022-2956?","acceptedAnswer":{"@type":"Answer","text":"Cross-site scripting (XSS) vulnerability in ConsoleTVs Noxen via the create_user_username parameter in /Noxen-master/users.php. An attacker can remotely inject a script payload (for example, >), and exploitation requires user interaction; CVSS v3.1 base score 3.5 (Low).\n"}},{"@type":"Question","name":"How severe is CVE-2022-2956?","acceptedAnswer":{"@type":"Answer","text":"CVE-2022-2956 has a CVSS score of 6.1 (Medium severity). EPSS score: 0.22% (45th percentile), indicating the estimated probability of exploitation in the wild."}},{"@type":"Question","name":"How do I fix CVE-2022-2956?","acceptedAnswer":{"@type":"Answer","text":"- Upgrade to the latest released version of Noxen or apply the vendor patch that fixes this issue.\n- If upgrading is not possible, modify /Noxen-master/users.php to sanitize and encode user-supplied input. For example, apply proper escaping (e.g., htmlspecialchars($_POST['create_user_username'], ENT_QUOTES, 'UTF-8')) before reflecting it in HTML, or implement strict input validation/whitelisting for this parameter.\n- Ensure all user-supplied data echoed back to the page is properly escaped to prevent reflection of scripts.\n- Implement a Content Security Policy (CSP) to mitigate XSS in case of future input handling gaps.\n- Consider enabling Web Application Firewall (WAF) rules to detect and block common XSS payloads.\n- Perform a code audit across the application to identify and remediate other potential reflection or input-handling vulnerabilities.\n"}}]},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://cve.armis.com/"},{"@type":"ListItem","position":2,"name":"CVE-2022-2956","item":"https://cve.armis.com/CVE-2022-2956"}]}]
CVE-2022-2956:
Cross-site scripting (XSS) vulnerability in ConsoleTVs Noxen via the create_user_username parameter in /Noxen-master/users.php. An attacker can remotely inject a script payload (for example, >alert(/xss/)), and exploitation requires user interaction; CVSS v3.1 base score 3.5 (Low).
Score
A numerical rating that indicates how dangerous this vulnerability is.
6.1Medium
Published Date:Aug 23, 2022
CISA KEV Date:*No Data*
Industries Affected:20
Threat Predictions
EPSS Score:0.2
EPSS Percentile:45%
Exploitability
Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:
NONE
User Interaction:REQUIRED
Scope:CHANGED
Impact
Score:2.7
Confidentiality Impact:LOW
Integrity Impact:LOW
Availability Impact:NONE
Description Preview
Cross-site scripting (XSS) vulnerability in ConsoleTVs Noxen via the create_user_username parameter in /Noxen-master/users.php. An attacker can remotely inject a script payload (for example, >alert(/xss/)), and exploitation requires user interaction; CVSS v3.1 base score 3.5 (Low).
Overview
ConsoleTVs Noxen contains a cross-site scripting vulnerability in the users.php component that reflects unsanitized input from the create_user_username parameter. An attacker can exploit this remotely by supplying a crafted payload such as >alert(/xss/), and the exploitation requires user interaction. The vulnerability is assigned CVSS v3.1 base score 3.5 (Low), with low integrity impact and no confidentiality or availability impact.
Remediation
Upgrade to the latest released version of Noxen or apply the vendor patch that fixes this issue.
If upgrading is not possible, modify /Noxen-master/users.php to sanitize and encode user-supplied input. For example, apply proper escaping (e.g., htmlspecialchars($_POST['create_user_username'], ENT_QUOTES, 'UTF-8')) before reflecting it in HTML, or implement strict input validation/whitelisting for this parameter.
Ensure all user-supplied data echoed back to the page is properly escaped to prevent reflection of scripts.
Implement a Content Security Policy (CSP) to mitigate XSS in case of future input handling gaps.
Consider enabling Web Application Firewall (WAF) rules to detect and block common XSS payloads.
Perform a code audit across the application to identify and remediate other potential reflection or input-handling vulnerabilities.
