CVE-2022-25869

All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of elements.

View graph Watch Export

CVSS v3.1

4.2 MEDIUM

EPSS

7.27%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

EPSS Trend

Aug 16, 2026 → Sep 9, 2026

▲ 0.45pp

6.82% → 7.27% over 2 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

ScopeUNCHANGED

ConfidentialityLOW

IntegrityLOW

AvailabilityNONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Connections

2 relationships

CWE-79

source

Timeline

disclosure → media coverage

Jul 15, 2022

Disclosure — published as a CVE record. · last revised by NVD Nov 20, 2025

Public PoC (1)

github.com/neverendingsupport/angularjs-poc-cve-2022-25869

Unverified third-party code — review before executing.