Security Vulnerabilities - CVEs Published In 2022
A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the file youthappam/brand.php. The manipulation of the argument brand_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214595.
CVSS Score
3.5
EPSS Score
0.004
Published
2022-11-30
SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS).
CVSS Score
6.1
EPSS Score
0.004
Published
2022-11-30
Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.
CVSS Score
2.4
EPSS Score
0.005
Published
2022-11-30
Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.
CVSS Score
5.3
EPSS Score
0.006
Published
2022-11-30
Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
CVSS Score
9.8
EPSS Score
0.012
Published
2022-11-30
A vulnerability was found in Sapido BR270n, BRC76n, GR297 and RB1732 and classified as critical. Affected by this issue is some unknown functionality of the file ip/syscmd.htm. The manipulation leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214592.
CVSS Score
6.3
EPSS Score
0.031
Published
2022-11-30
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.
CVSS Score
5.4
EPSS Score
0.004
Published
2022-11-30
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
CVSS Score
6.2
EPSS Score
0.007
Published
2022-11-30
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
CVSS Score
6.8
EPSS Score
0.007
Published
2022-11-30
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.
CVSS Score
5.3
EPSS Score
0.004
Published
2022-11-30