Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2022-47968: Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
CVE-2022-47968 · published 3 years ago
Summary
Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| linuxserver | heimdall_application_dashboard |
<= 2.5.4 cpe:2.3:a:linuxserver:heimdall_application_dashboard:*:*:*:*:*:*:*:* |
Original advisory text
Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/47xxx/CVE-2022-47968... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-47968 Vendor Advisory
- https://github.com/linuxserver/Heimdall/issues/1086 Third Party Advisory
- https://samy.link/blog Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published27 Dec 2022
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta