{"uuid": "4a8ae743-ab0e-4475-ab44-3f1a9fa3ff9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-39195", "type": "seen", "source": "https://t.me/hacking_Attack/85762", "content": "Exploit Collector\nLISTSERV 17 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png \nLISTSERV version 17 suffers from a cross site scripting vulnerability.\n\nSHA-256 | a9a8b415b7acc7283581ad2d0efab8879f10d354798b0bb5cf0f33f5654b7d78\n\nDownload\n# Exploit Title: LISTSERV 17 - Reflected Cross Site Scripting (XSS)\n# Exploit Author: Shaunt D\n# Vendor Homepage: https://www.lsoft.com/\n# Version: 17\n# Tested on: Windows Server 2019\n# CVE : CVE-2022-39195\n\nA reflected cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the \"c\" parameter.\n\nTo reproduce, please visit\n\nhttp://localhost/scripts/wa.exe?TICKET=test&c=%3Cscript%3Ealert(1)%3C/script%3E\n(or whichever URL you can use for testing instead of localhost).\n\nThe \"c\" parameter will reflect any value given onto the page.\n\n# Solution\n\nThis vulnerability can be mitigated by going under \"Server Administration\" to \"Web Templates\" and editing the BODY-LCMD-MESSAGE web template. Change &+CMD; to &+HTMLENCODE(&+CMD;); .\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:27.365861Z"}