← Vulnerability feed

Vulnerability record · CVE-2022-25523 · published 25 March 2022

CVE-2022-25523: Typesettercms typesetter cross-site request forgery vulnerability

Typesettercms · Typesetter

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.

8.8 CVSS 3.1 High EPSS 0.55% · top 56.0% CWE-352 · Cross-site request forgery
8.8CVSS 3.1 base score, v2 6.8
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
9 Jul 2026Last modified by NVD

Description

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/Typesetter/Typesetter/issues/697 ExploitThird Party Advisory
https://www.typesettercms.com/User Permissions RequiredProduct
https://github.com/Typesetter/Typesetter/issues/697 ExploitThird Party Advisory
https://www.typesettercms.com/User Permissions RequiredProduct

Track CVE-2022-25523 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2018-6889Typesettercms typesetter code injection vulnerabilityAn issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the …EPSS 6.7%8.0CVE-2018-6888Typesettercms typesetter cross-site request forgery vulnerabilityAn issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: usin…EPSS 1.9%7.2CVE-2020-25790Typesettercms typesetter unrestricted file upload vulnerabilityTypesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes…EPSS 16%6.1CVE-2020-19511Typesettercms typesetter cross-site scripting vulnerabilityCross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,EPSS 0.83%5.4CVE-2018-16639Typesettercms typesetter cross-site scripting vulnerabilityTypesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.EPSS 0.68%4.8CVE-2025-71164Typesettercms typesetter cross-site scripting vulnerabilityTypesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images par…EPSS 0.23%4.8CVE-2025-71165Typesettercms typesetter cross-site scripting vulnerabilityTypesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within t…EPSS 0.23%4.8CVE-2025-71166Typesettercms typesetter cross-site scripting vulnerabilityTypesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within t…EPSS 0.23%

Source: NIST National Vulnerability Database (record CVE-2022-25523), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.