2022 CVEs (page 200)
Page 200 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31951 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_respondent_type. |
CVE-2022-31948 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_report. |
CVE-2022-31946 | Critical | 9.8 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via /rdms/classes/Master.php?f=delete_team. |
CVE-2022-31945 | Critical | 9.1 | 2022-06-02 | Rescue Dispatch Management System v1.0 is vulnerable to Delete any file via /rdms/classes/Master.php?f=delete_img. |
CVE-2022-31799 | Critical | 9.8 | 2022-06-02 | Bottle before 0.12.20 mishandles errors during early request binding. |
CVE-2022-31796 | Medium | 6.5 | 2022-06-02 | libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be diffe… |
CVE-2022-31783 | Medium | 5.5 | 2022-06-02 | Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace. |
CVE-2022-31782 | High | 7.8 | 2022-06-02 | ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow. |
CVE-2022-31500 | High | 7.8 | 2022-06-02 | In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions. |
CVE-2022-31354 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=get_vehicle_service. |
CVE-2022-31353 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/services/view_service.php?id=. |
CVE-2022-31352 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 by oretnom23 has SQL injection in /ocwbs/admin/services/manage_service.php?id=. |
CVE-2022-31351 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 by oretnom23 has SQL injection via /ocwbs/admin/services/manage_price.php?id=. |
CVE-2022-31350 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/vehicles/manage_vehicle.php?id=. |
CVE-2022-31348 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/bookings/update_status.php?id=. |
CVE-2022-31347 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_vehicle. |
CVE-2022-31346 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_service. |
CVE-2022-31345 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=user/manage_user&id=. |
CVE-2022-31344 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/classes/Master.php?f=delete_booking. |
CVE-2022-31343 | Critical | 9.8 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=bookings/view_details&id=. |
CVE-2022-31342 | Medium | 6.5 | 2022-06-02 | Online Car Wash Booking System v1.0 is vulnerable to Delete any file via /ocwbs/classes/Master.php?f=delete_img. |
CVE-2022-31340 | Critical | 9.8 | 2022-06-02 | Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/table_edit_ajax.php. |
CVE-2022-31339 | High | 7.2 | 2022-06-02 | Simple Inventory System v1.0 is vulnerable to SQL Injection via /inventory/login.php. |
CVE-2022-31338 | Critical | 9.8 | 2022-06-02 | Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=. |
CVE-2022-31337 | Critical | 9.8 | 2022-06-02 | Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/category/index.php?view=edit&id=. |
CVE-2022-31336 | Critical | 9.8 | 2022-06-02 | Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/loaddata.php. |
CVE-2022-31335 | Critical | 9.8 | 2022-06-02 | Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit&id=. |
CVE-2022-31329 | Critical | 9.8 | 2022-06-02 | Online Ordering System By janobe 2.3.2 is vulnerable to SQL Injection via /ordering/admin/orders/loaddata.php. |
CVE-2022-31328 | Critical | 9.8 | 2022-06-02 | Online Ordering System By janobe 2.3.2 has SQL Injection via /ordering/admin/products/index.php?view=edit&id=. |
CVE-2022-31327 | Critical | 9.8 | 2022-06-02 | Online Ordering System By janobe 2.3.2 is vulneranle to SQL Injection via /ordering/index.php?q=products&id=. |
CVE-2022-31004 | High | 7.5 | 2022-06-02 | CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be w… |
CVE-2022-30999 | High | 8.7 | 2022-06-02 | FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is configured to allo… |
CVE-2022-30836 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection. via Wedding-Management/admin/select.php. |
CVE-2022-30835 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection. via /Wedding-Management/admin/budget.php?booking_id=. |
CVE-2022-30834 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_details.php?booking_id=31&user_id= |
CVE-2022-30833 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&user_id=. |
CVE-2022-30832 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_assign.php?booking=31&user_id=. |
CVE-2022-30831 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php. |
CVE-2022-30830 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\feature_edit.php. |
CVE-2022-30829 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\users_edit.php. |
CVE-2022-30828 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\photos_edit.php. |
CVE-2022-30827 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\package_edit.php. |
CVE-2022-30826 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via admin\client_assign.php. |
CVE-2022-30825 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\client_edit.php. |
CVE-2022-30823 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL Injection via \admin\blog_events_edit.php. |
CVE-2022-30822 | High | 8.8 | 2022-06-02 | In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file. |
CVE-2022-30821 | High | 8.8 | 2022-06-02 | In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability… |
CVE-2022-30820 | High | 8.8 | 2022-06-02 | In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file. |
CVE-2022-30819 | High | 8.8 | 2022-06-02 | In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file. |
CVE-2022-30818 | High | 7.2 | 2022-06-02 | Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31. |
CVE-2022-30817 | Critical | 9.8 | 2022-06-02 | Simple Bus Ticket Booking System 1.0 is vulnerable to SQL Injection via /SimpleBusTicket/index.php. |
CVE-2022-30816 | Critical | 9.8 | 2022-06-02 | elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php. |
CVE-2022-30815 | Critical | 9.8 | 2022-06-02 | elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar= |
CVE-2022-30814 | Critical | 9.8 | 2022-06-02 | elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php. |
CVE-2022-30813 | Critical | 9.8 | 2022-06-02 | elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php. |
CVE-2022-30810 | Critical | 9.8 | 2022-06-02 | elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php. |
CVE-2022-30809 | Critical | 9.8 | 2022-06-02 | elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=. |
CVE-2022-30808 | Critical | 9.8 | 2022-06-02 | elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php. |
CVE-2022-30804 | Medium | 6.5 | 2022-06-02 | elitecms v1.01 is vulnerable to Delete any file via /admin/delete_image.php?file=. |
CVE-2022-30799 | High | 7.2 | 2022-06-02 | Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php. |
CVE-2022-30798 | High | 7.2 | 2022-06-02 | Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/viewreport.php. |
CVE-2022-30797 | Critical | 9.8 | 2022-06-02 | Online Ordering System 1.0 by oretnom23 is vulnerable to SQL Injection via admin/vieworders.php. |
CVE-2022-30795 | High | 7.2 | 2022-06-02 | Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductimage.php. |
CVE-2022-30794 | High | 7.2 | 2022-06-02 | Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php. |
CVE-2022-30540 | High | 7.8 | 2022-06-02 | The affected product is vulnerable to a heap-based buffer overflow via uninitialized pointer, which may allow an attacker to execute arbitrary code |
CVE-2022-30521 | Critical | 9.8 | 2022-06-02 | The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and… |
CVE-2022-30514 | Medium | 6.1 | 2022-06-02 | School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126. |
CVE-2022-30513 | Medium | 6.1 | 2022-06-02 | School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125 |
CVE-2022-30512 | Critical | 9.8 | 2022-06-02 | School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31. |
CVE-2022-30511 | Critical | 9.8 | 2022-06-02 | School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4. |
CVE-2022-30510 | Critical | 9.8 | 2022-06-02 | School Dormitory Management System 1.0 is vulnerable to SQL Injection via reports/daily_collection_report.php:59. |
CVE-2022-30506 | Critical | 9.8 | 2022-06-02 | An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file. |
CVE-2022-30503 | Medium | 5.5 | 2022-06-02 | Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h. |
CVE-2022-30496 | High | 7.5 | 2022-06-02 | SQL injection in Logon Page of IDCE MV's application, version 1.0, allows an attacker to inject SQL payloads in the user field, connecting to a database to acc… |
CVE-2022-30490 | Critical | 9.8 | 2022-06-02 | Badminton Center Management System V1.0 is vulnerable to SQL Injection via parameter 'id' in /bcms/admin/court_rentals/update_status.php. |
CVE-2022-30482 | Medium | 4.8 | 2022-06-02 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar- 1.0 is vulnerable to Cross Site Scripting (XSS) in \admin\add_cata.php via the ctg_name parameters. |
CVE-2022-30481 | Critical | 9.8 | 2022-06-02 | Food-order-and-table-reservation-system- 1.0 is vulnerable to SQL Injection in categorywise-menu.php via the catid parameters. |
CVE-2022-30478 | Critical | 9.8 | 2022-06-02 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in \search_product.php via the keyword parameters. |
CVE-2022-30470 | Critical | 9.8 | 2022-06-02 | In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the conte… |
CVE-2022-30425 | High | 8.8 | 2022-06-02 | Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerabi… |
CVE-2022-30423 | Critical | 9.8 | 2022-06-02 | Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information. |
CVE-2022-30352 | Critical | 9.8 | 2022-06-02 | phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "auth_user" parameter in index.php script. |
CVE-2022-30349 | Medium | 6.1 | 2022-06-02 | siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-30324 | Critical | 9.8 | 2022-06-02 | HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact st… |
CVE-2022-30277 | Medium | 5.7 | 2022-06-02 | BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, m… |
CVE-2022-30115 | Medium | 4.3 | 2022-06-02 | Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. Thi… |
CVE-2022-30034 | High | 8.6 | 2022-06-02 | Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then acc… |
CVE-2022-29788 | Medium | 6.5 | 2022-06-02 | libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2022-29780 | Medium | 5.5 | 2022-06-02 | Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_array.c. |
CVE-2022-29779 | Medium | 5.5 | 2022-06-02 | Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_value.c. |
CVE-2022-29777 | Critical | 9.8 | 2022-06-02 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via the component DesktopEditor/fontengine/f… |
CVE-2022-29776 | Critical | 9.8 | 2022-06-02 | Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via the component DesktopEditor/common/File… |
CVE-2022-29735 | High | 8.8 | 2022-06-02 | Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2022-29734 | Medium | 5.4 | 2022-06-02 | A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2022-29733 | Medium | 5.9 | 2022-06-02 | Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allo… |
CVE-2022-29732 | Medium | 6.1 | 2022-06-02 | Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vulnerability via the Username parameter… |
CVE-2022-29731 | Medium | 4.3 | 2022-06-02 | An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users. |
CVE-2022-29730 | Critical | 9.8 | 2022-06-02 | USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. The credentials cann… |
CVE-2022-29729 | High | 7.5 | 2022-06-02 | Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which generates passwords that are accessibl… |
CVE-2022-29725 | High | 8.8 | 2022-06-02 | An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via a crafted PHP file. |