CVE-2022-2702

SourceCodester Company Website CMS Cookie site-settings.php access control

A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file site-settings.php of the component Cookie Handler. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-205826 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Company Website\/cms Project

Products

Company Website\/cms

CVE-2022-2766

SourceCodester Loan Management System index.php sql injection

A vulnerability was found in SourceCodester Loan Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-206162 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed

Vendors

Razormist

Products

Loan Management System

CVE-2022-2802

SourceCodester Gas Agency Management System login.php sql injection

A vulnerability has been found in SourceCodester Gas Agency Management System and classified as critical. This vulnerability affects unknown code of the file gasmark/login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206248.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gas Agency Management System Project

Products

Gas Agency Management System

CVE-2022-2812

SourceCodester Guest Management System index.php sql injection

A vulnerability classified as critical was found in SourceCodester Guest Management System. This vulnerability affects unknown code of the file index.php. The manipulation of the argument username/pass leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-206398 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Guest Management System Project

Products

Guest Management System

CVE-2022-2842

SourceCodester Gym Management System login.php sql injection

A vulnerability classified as critical has been found in SourceCodester Gym Management System. This affects an unknown part of the file login.php. The manipulation of the argument user_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-206451.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gym Management System Project

Products

Gym Management System

CVE-2022-3118

Sourcecodehero ERP System Project processlogin.php sql injection

A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing of the file /pages/processlogin.php. The manipulation of the argument user leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207845 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Erp System Project Project

Products

Erp System Project

CVE-2022-3120

SourceCodester Clinics Patient Management System Login index.php sql injection

A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-207847.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Clinic\'s Patient Management System

CVE-2022-3130

codeprojects Online Driving School login.php sql injection

A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207873 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Online Driving School Project Project

Products

Online Driving School Project

CVE-2022-3465

Mediabridge Medialink index.asp improper authentication

A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mediabridgeproducts

Products

Mlwr-ac1200r Mlwr-ac1200r Firmware

CVE-2022-3495

SourceCodester Simple Online Public Access Catalog Admin Login sql injection

A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210784.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Simple Online Public Access Catalog Project

Products

Simple Online Public Access Catalog

CVE-2022-3526

Linux Kernel skb macvlan.c macvlan_handle_frame memory leak

A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2022-3583

SourceCodester Canteen Management System login.php sql injection

A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument business leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-211192.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2022-3662

Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free

A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3663

Axiomatic Bento4 MP4fragment Ap4StsdAtom.cpp AP4_StsdAtom null pointer dereference

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3664

Axiomatic Bento4 avcinfo Ap4BitStream.cpp WriteBytes heap-based overflow

A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3665

Axiomatic Bento4 avcinfo AvcInfo.cpp heap-based overflow

A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212005 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3666

Axiomatic Bento4 mp42ts Ap4LinearReader.cpp Advance use after free

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2025-30292

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

CVSS 3.1 · 6.1 Medium EPSS 15.5% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2022-3667

Axiomatic Bento4 mp42aac Ap4ByteStream.cpp WritePartial heap-based overflow

A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212007.

CVSS 3.1 · 7.3 High EPSS 1.5% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3668

Axiomatic Bento4 mp4edit CreateAtomFromStream memory leak

A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212008.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4