Ghost 5.9.4 for Node.js
Approved changes feed: RSS · Atom
cpe:2.3:a:ghost:ghost:5.9.4:*:*:*:*:node.js:*:*
part: a version: 5.9.4 update: *
| Vendor | Ghost (b50ba6a2-6882-52df-b0fe-d50a87f187b5) |
|---|---|
| Product | Ghost (83aefbd7-a394-51e0-96b0-2576e4ed74c8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-47197 |
vulnerable | 2026-06-08 05:50:39.993412 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
Published: 2023-01-19T17:02:15.814Z
Updated: 2025-11-04T19:14:29.704Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47196 |
vulnerable | 2026-06-08 05:50:39.992949 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.
Published: 2023-01-19T17:02:15.737Z
Updated: 2025-11-04T19:14:28.608Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47195 |
vulnerable | 2026-06-08 05:50:39.992360 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
Published: 2023-01-19T17:02:15.655Z
Updated: 2025-11-04T19:14:27.525Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47194 |
vulnerable | 2026-06-08 05:50:39.991566 |
Details available
CRITICAL (9)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `twitter` field for a user.
Published: 2023-01-19T17:02:10.446Z
Updated: 2025-11-04T19:14:26.423Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-41697 |
vulnerable | 2026-06-08 05:48:30.810212 |
Details available
MEDIUM (5.3)
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send a series of HTTP requests to trigger this vulnerability.
Published: 2022-12-23T23:03:51.372Z
Updated: 2025-04-14T18:07:42.762Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.