Security readout for executives and security teams
Plain-English summary
CVE-2022-40434 describes HTML injection in Softr v2.0 through the Account page Name field. If exploitable in a real deployment, attacker-controlled content could appear inside account-related pages. The source bundle rates it critical, but product scope, fixed versions, and vendor remediation are not specified.
Executive priority
Treat this as a priority triage item if Softr v2.0 is used in customer, partner, or employee-facing workflows. Urgency should depend on confirmed exposure because the public record is sparse despite the critical CVSS score.
Technical view
The record maps the issue to CWE-79 and describes unsanitized HTML handling in a user-controllable account Name field. The CVSS 3.1 vector is 9.8, network-accessible, low complexity, and no privileges or user interaction required. The affected vendor/product fields are listed as n/a, limiting validation certainty.
Likely exposure
Exposure is most likely limited to environments using Softr v2.0 where account profile names are accepted and rendered. The CVE data does not define CPEs, deployment models, fixed versions, or whether current Softr-hosted services remain affected.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. Public details identify the input location but do not provide reliable exploitation prevalence, impact proof, or remediation status.
Researcher notes
The record is unusually thin: affected product metadata is n/a, the description is short, and no patch details are provided. Validate scope carefully before escalating beyond Softr v2.0 Account page Name field exposure.
Mitigation direction
- Confirm whether any application uses Softr v2.0 account pages.
- Check Softr guidance or support for remediation status and fixed versions.
- Reduce trust in user-controlled profile display fields until confirmed remediated.
- Review account records for unexpected markup in name values.
- Apply vendor-provided updates or platform remediation when identified.
Validation and detection
- Inventory Softr usage and confirm version or hosted platform status.
- Compare findings against the CVE record and Softr support guidance.
- In a controlled environment, assess whether account names render unsafe HTML.
- Review logs and account data for suspicious name-field changes.
- Document whether exposure is present, absent, or unverifiable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-40434 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.softr.io/CVE reference, mitre
- https://isaghojaria.medium.com/softr-v2-0-was-discovered-to-be-vulnerable-to-html-injection-via-the-name-field-of-the-account-page-c6fbd3162254CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.