CVE-2022-46xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
637 records · Page 7 of 7
Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/manage_brand.php?id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=client/manage_client&id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage_user&id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage_category.php?id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view_category.php?id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product_per_brand&bid=.
UpdatedHelmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view_product&id=.
UpdatedTenda AC15 V15.03.06.23 is vulnerable to Buffer Overflow via function formSetClientState.
Updated- CVE-2022-46102: AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php 9.8 Critical
AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php
Updated AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code.
UpdatedA Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execute arbitrary code via the txtfullname parameter or txtphone parameter to register.php without logging in.
UpdatedSourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verification.php because the program does not verify the txtvaccinationID parameter.
UpdatedHospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the need for a password.
UpdatedCross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.
UpdatedCross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.
UpdatedOnline Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form.
UpdatedCloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin users through notification received by the admin user.
UpdatedIn Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information. NOTE: this is disputed by the vendor because the LiveTrack API service is not a customer-controlled product.
UpdatedNexxt Nebula 1200-AC 15.03.06.60 allows authentication bypass and command execution by using the HTTPD service to enable TELNET.
Updated- CVE-2022-46076: D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi. 7.5 High
D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi.
Updated Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection.
UpdatedHelmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS).
Updated- CVE-2022-46072: Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection. 9.8 Critical
Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection.
Updated There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access.
UpdatedGV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.
Updated- CVE-2022-46062: Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). 4.5 Medium
Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
Updated AeroCMS v0.0.1 is vulnerable to ClickJacking.
UpdatedAeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
UpdatedAeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.
UpdatedThe approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.
UpdatedAeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.
UpdatedTotolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.
UpdatedX-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.
Updated- CVE-2022-46020: WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. 9.8 Critical
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type.
Updated