References https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1156793 https://nvd.nist.gov/vuln/detail/CVE-2022-38463 https://hishowcase.service-now.com/kb?id=kb_article_view&sysparm_article=KB1310230 https://zh-tw.tenable.com/plugins/was/113341 https://github.com/CapgeminiCisRedTeam/Disclosure/blob/main/CVE%20PoC/CVE-2023-1298%20%7C%20ServiceNow%20%E2%80%93%20Reflected%20Cross-site%20Scripting%20(XSS).md https://www.cve.org/CVERecord?id=CVE-2022-38463 https://www.cve.org/CVERecord?id=CVE-2023-1298 https://hackerone.com/reports/1681208 https://www.reddit.com/r/servicenow/comments/x8hlny/xss_vulnerabilities_discovered_in_servicenow/
Related VulnerabilitiesGitea /api/v1/repos/diffpatch 代码执行漏洞(CVE-2026-60004)用友U8Cloud /ServiceDispatcherServlet 文件上传漏洞深信服运维安全管理系统 /fort/system;help/concentration_management/uninstall_patch 命令执行漏洞深信服运维安全管理系统 /fort/system;help/concentration_management/del_patch 命令执行漏洞PoC福建科立讯通信指挥调度平台 /dm/dispatch/user/upload 文件上传漏洞PoC福建科立讯通信指挥调度平台 /dm/dispatch/channel/upload 文件上传漏洞PoCyonyou-u9-patchfile-upload: Yonyou U9 PatchFile.asmx - Unauthenticated Arbitrary File Upload用友 U8 Cloud /ServiceDispatcherServlet IFileTrans 文件上传漏洞用友 U8 Cloud /ServiceDispatcherServlet IPFxxFileService 文件上传漏洞(CVE-2025-9910)jsondiffpatch 0.7.2前版本跨站脚本漏洞关于U8cloud所有版本存在ServiceDispatcherServlet反序列化补丁绕过实现文件上传漏洞的安全公告