CVE-2022

CVE	CVE Description	Reference
CVE-2022-31470	An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.	https://www.exploit-db.com/exploits/51722
CVE-2022-35919	MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.	https://www.exploit-db.com/exploits/51734
CVE - 2022-4944	A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.	https://www.exploit-db.com/exploits/51388
CVE-2022-43939	Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.	https://www.exploit-db.com/exploits/51350
CVE-2022-43769	Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.	https://www.exploit-db.com/exploits/51350
CVE-2022-48177	X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.	https://www.exploit-db.com/exploits/51346
CVE-2022-25630	An authenticated user can embed malicious content with XSS into the admin group policy page.	https://www.exploit-db.com/exploits/51342
CVE-2022-40347	SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attackers to execute arbitrary code and gain sensitive information.	https://www.exploit-db.com/exploits/51274
CVE-2022-40032	SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information.	https://www.exploit-db.com/exploits/51273
CVE-2022-48110	CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).	https://www.exploit-db.com/exploits/51260
CVE-2022-28598	Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.	https://www.exploit-db.com/exploits/51255
CVE-2022-46604	An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.	https://www.exploit-db.com/exploits/51251
CVE-2022-34128	The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.	https://www.exploit-db.com/exploits/51234
CVE-2022-31056	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.	https://www.exploit-db.com/exploits/51233
CVE-2022-31161	Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.	https://www.exploit-db.com/exploits/51228
CVE-2022-31126	Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.	https://www.exploit-db.com/exploits/51227
CVE-2022-24637	Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.	https://www.exploit-db.com/exploits/51026
CVE-2022-2840	The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections	https://www.exploit-db.com/exploits/51024
CVE-2022-2941	The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	https://www.exploit-db.com/exploits/51020
CVE-2022-36633	Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.	https://www.exploit-db.com/exploits/51019
CVE-2022-36267	In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.	https://www.exploit-db.com/exploits/51011
CVE-2022-1040	An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.	https://www.exploit-db.com/exploits/51006
CVE-2022-34140	A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.	https://www.exploit-db.com/exploits/51002
CVE-2022-20277	There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.	https://www.exploit-db.com/exploits/51000
CVE-2022-31325	There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.	https://www.exploit-db.com/exploits/50965
CVE-2022-31885	Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.	https://www.exploit-db.com/exploits/50956
CVE-2022-29296	A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.	https://www.exploit-db.com/exploits/50955
CVE-2022-26134	In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.	https://www.exploit-db.com/exploits/50952
CVE-2022-29298	SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.	https://www.exploit-db.com/exploits/50950
CVE-2022-23626	m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.	https://www.exploit-db.com/exploits/50943
CVE-2022-0967	Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.	https://www.exploit-db.com/exploits/50941
CVE-2022-29303	SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.	https://www.exploit-db.com/exploits/50940
CVE-2022-29727	Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter.	https://www.exploit-db.com/exploits/50937
CVE-2022-28080	Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.	https://www.exploit-db.com/exploits/50934
CVE-2022-28079	College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.	https://www.exploit-db.com/exploits/50933
CVE-2022-27308	A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project title.	https://www.exploit-db.com/exploits/50922
CVE-2022-27412	Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.	https://www.exploit-db.com/exploits/50920
CVE-2022-24707	Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.	https://www.exploit-db.com/exploits/50915
CVE-2022-28213	When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.	https://www.exploit-db.com/exploits/50900
CVE-2022-1175	mproper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.	https://www.exploit-db.com/exploits/50889
CVE-2022-1104	The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed	https://www.exploit-db.com/exploits/50876
CVE-2022-1163	Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.	https://www.exploit-db.com/exploits/50853
CVE-2022-0824	Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.	https://www.exploit-db.com/exploits/50809
CVE-2022-23366	HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.	https://www.exploit-db.com/exploits/50729
CVE-2022-24223	AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.	https://www.exploit-db.com/exploits/50727
CVE-2022-0448	The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.	https://www.exploit-db.com/exploits/50724
CVE-2022-0332	A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.	https://www.exploit-db.com/exploits/50700
CVE-2022-24263	Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.	https://www.exploit-db.com/exploits/50718
CVE-2022-23046	PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php	https://www.exploit-db.com/exploits/50684
CVE-2022-21661	WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.	https://www.exploit-db.com/exploits/50663
CVE-2022-22965	A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.	https://pentest-tools.com/blog/detect-exploit-spring4shell-cve-2022-22965