Back Sploitus

CVE-2022

Sploitus • September 28, 2026

Share: View original

##

Haraj Script 3.7 - DM Section Authenticated Stored XSS

#### Exploit Title: Haraj Script 3.7 - Authenticated Stored XSS

#### Exploit Author: Abdulaziz Saad (@b4zb0z)

#### Vendor Homepage:

#### Software Link:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2025 and CVE-2022 Exploits Targeting Haraj Script Recent reports detail two vulnerabilities, CVE-2025 and CVE-2022, affecting the Haraj Script. CVE-2025 involves a POST request exploit that could allow unauthorized transactions, impacting users of the Haraj platform. CVE-2022 is an authenticated stored XSS vulnerability in Haraj Script 3.7, potentially affecting users who authenticate on the platform. The exploit for CVE-2025 was disclosed on September 24, 2026, while CVE-2022 was reported on September 28, 2026. The scope of the impact for CVE-2025 is unclear, but it raises concerns about transaction security. The details of CVE-2022 indicate that it could allow attackers to execute scripts in the context of authenticated users. Both vulnerabilities require immediate attention from security professionals to mitigate risks. Currently, there are no confirmed reports of active exploitation for either CVE. 2 sources 34

Extracted Entities

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)

Vulnerabilities (2)