CVE-2022-47195
Quick assessment
Affected
Ghost Foundation Ghost
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghost Foundation Ghost是Ghost开源的一款用 JavaScript 编写的个人博客系统。 Ghost Foundation Ghost 5.9.4存在安全漏洞，该漏洞源于Ghost Foundation Ghost 5.9.4 的创建后功能中存在一个不安全的默认漏洞。 Ghost 的默认安装允许非管理员用户在帖子中注入任意 Javascript，从而允许通过 XSS 将权限提升到管理员。 要触发此漏洞，攻击者可以发送 HTTP 请求在帖子中注入 Javascript，以诱使管理员访
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-47195
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的缺省变量初始化
Source: CVE Program / CVE List V5
Vulnerability Title
Ghost Foundation Ghost 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ghost Foundation Ghost是Ghost开源的一款用 JavaScript 编写的个人博客系统。 Ghost Foundation Ghost 5.9.4存在安全漏洞，该漏洞源于Ghost Foundation Ghost 5.9.4 的创建后功能中存在一个不安全的默认漏洞。 Ghost 的默认安装允许非管理员用户在帖子中注入任意 Javascript，从而允许通过 XSS 将权限提升到管理员。 要触发此漏洞，攻击者可以发送 HTTP 请求在帖子中注入 Javascript，以诱使管理员访
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ghost Foundation | Ghost | 5.9.4 | - |
|
II. Public POCs for CVE-2022-47195
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-47195
请登录查看更多情报信息。
Other References for CVE-2022-47195 (1)
Same Patch Batch · Ghost Foundation · 2023-01-19 · 4 CVEs total
| CVE-2022-47194 | Ghost Foundation Ghost 安全漏洞 | |
| CVE-2022-47196 | Ghost Foundation Ghost 安全漏洞 | |
| CVE-2022-47197 | Ghost Foundation Ghost 跨站脚本漏洞 |
IV. Related Vulnerabilities
Same product: Ghost
-
CVE-2026-104417
Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting -
CVE-2026-104418
Ghost from 6.10.3 before 6.64.0 RCE via Theme Translation Fi -
CVE-2026-104416
Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin -
CVE-2026-104414
Ghost from 2.5.0 before 6.64.0 Stored XSS via oEmbed Photo R -
CVE-2026-104415
Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure
Same weakness: CWE-453
-
CVE-2026-92950
vm2 before 3.11.7 Sandbox Escape via CLI require -
CVE-2026-41330
OpenClaw < 2026.3.31 - Environment Variable Override via Hos -
CVE-2025-61926
Allstar Reviewbot has Authentication Bypass via Hard-coded W -
CVE-2025-47945
Donetick Has Weak Default JWT Secret -
CVE-2024-49120
Windows Remote Desktop Services Remote Code Execution Vulner
V. Comments for CVE-2022-47195
No comments yet