Vulnerabilites CVE
Base de donnees CVE enrichie avec CISA KEV et NVD
| CVE ID | CVSS | Severite | KEV | Observations |
|---|---|---|---|---|
| CVE-2022-25757 In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-1440 Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line arg... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26293 Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function save_employee at /ptms/classes/Users.php. | 9.8 | CRITICAL | — | 0 |
| CVE-2021-45786 In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges. | 9.8 | CRITICAL | — | 0 |
| CVE-2021-43453 A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parser_parse_for_statement_start in the js-parser-statm.c file. This issue is sim... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27404 FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face. | 9.8 | CRITICAL | — | 0 |
| CVE-2021-43958 Various rest resources in Fisheye and Crucible before version 4.8.9 allowed remote attackers to brute force user login credentials as rest resources did not check if users were beyond their max failed... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-0541 The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix co... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26674 ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remote arbitrary code execution, arbitrary system oper... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26612 In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extra... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28417 Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28034 AtomCMS 2.0 is vulnerabie to SQL Injection via Atom.CMS_admin_ajax_list-sort.php | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28416 Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28035 Atom.CMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_blur-save.php | 9.8 | CRITICAL | — | 0 |
| CVE-2021-45807 jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28415 Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27005 Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. Th... | 9.8 | CRITICAL | — | 0 |
| CVE-2021-33046 Some Dahua products have access control vulnerability in the password reset process. Attackers can exploit this vulnerability through specific deployments to reset device passwords. | 9.8 | CRITICAL | — | 0 |
| CVE-2021-40722 AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27004 Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28414 Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28036 AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMS_admin_ajax_navigation.php | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27003 Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. T... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27002 Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters. This vulnerability allows attackers to ... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27001 Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27000 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. This ... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28413 Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27139 An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's sec... | 9.8 | CRITICAL | — | 0 |
| CVE-2020-13567 Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26631 Automatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability via the id GET parameter. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26999 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. This ... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27140 An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file. NOTE: the vendor's position is that the ... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28412 Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27423 Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27260 An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27262 An arbitrary file upload vulnerability in the file upload module of Skipper v0.9.1 allows attackers to execute arbitrary code via a crafted file. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28056 ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27263 An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-27952 An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-28397 An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26998 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary... | 9.8 | CRITICAL | — | 0 |
| CVE-2021-43741 CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26171 Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26997 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows attackers to execute arbitrary commands via ... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-0412 The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL stateme... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26809 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26170 Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-26169 Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-25399 Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-25398 Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter. | 9.8 | CRITICAL | — | 0 |
This product uses data from the NVD API but is not endorsed or certified by the NVD.