What’s Vulnerable › Vulnerabilities

CVE-2022-4590: mschaef toto Todo List cross site scripting

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-17 · updated 2026-06-17
• Weakness: CWE-707

Description

A vulnerability was found in mschaef toto up to 1.4.20. It has been classified as problematic. This affects an unknown part of the component Todo List Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.4.21 is able to address this issue. The name of the patch is fdc825ac5249f40683377e8a526a06cdc6870125. It is recommended to upgrade the affected component. The identifier VDB-216177 was assigned to this vulnerability.

Affected products

• mschaef toto: before 1.4.21 — fixed in 1.4.21

How to fix

Upgrade to a fixed version: mschaef toto 1.4.21. Check the vendor advisory for mitigations.

References

• https://github.com/mschaef/toto/commit/fdc825ac5249f40683377e8a526a06cdc6870125
• https://github.com/mschaef/toto/releases/tag/1.4.21
• https://vuldb.com/?id.216177
• https://github.com/mschaef/toto/commit/fdc825ac5249f40683377e8a526a06cdc6870125
• https://github.com/mschaef/toto/releases/tag/1.4.21
• https://vuldb.com/?id.216177

Get alerted when CVE-2022-4590 or the next vulnerability affects your stack