CVE-2022-3465

Mediabridge Medialink index.asp improper authentication

A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mediabridgeproducts

Products

Mlwr-ac1200r Mlwr-ac1200r Firmware

CVE-2022-3495

SourceCodester Simple Online Public Access Catalog Admin Login sql injection

A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210784.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Simple Online Public Access Catalog Project

Products

Simple Online Public Access Catalog

CVE-2022-3526

Linux Kernel skb macvlan.c macvlan_handle_frame memory leak

A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2022-3583

SourceCodester Canteen Management System login.php sql injection

A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument business leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-211192.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2022-3662

Axiomatic Bento4 mp42hls Ap4Sample.h GetOffset use after free

A vulnerability was found in Axiomatic Bento4. It has been declared as critical. This vulnerability affects the function GetOffset of the file Ap4Sample.h of the component mp42hls. The manipulation leads to use after free. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212002 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3663

Axiomatic Bento4 MP4fragment Ap4StsdAtom.cpp AP4_StsdAtom null pointer dereference

A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. This issue affects the function AP4_StsdAtom of the file Ap4StsdAtom.cpp of the component MP4fragment. The manipulation leads to null pointer dereference. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212003.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3664

Axiomatic Bento4 avcinfo Ap4BitStream.cpp WriteBytes heap-based overflow

A vulnerability classified as critical has been found in Axiomatic Bento4. Affected is the function AP4_BitStream::WriteBytes of the file Ap4BitStream.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212004.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3665

Axiomatic Bento4 avcinfo AvcInfo.cpp heap-based overflow

A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is an unknown functionality of the file AvcInfo.cpp of the component avcinfo. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212005 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3666

Axiomatic Bento4 mp42ts Ap4LinearReader.cpp Advance use after free

A vulnerability, which was classified as critical, has been found in Axiomatic Bento4. Affected by this issue is the function AP4_LinearReader::Advance of the file Ap4LinearReader.cpp of the component mp42ts. The manipulation leads to use after free. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212006 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2025-30292

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

CVSS 3.1 · 6.1 Medium EPSS 15.5% KEV · Not listed

Vendors

Adobe

Products

Coldfusion

CVE-2022-3667

Axiomatic Bento4 mp42aac Ap4ByteStream.cpp WritePartial heap-based overflow

A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4_MemoryByteStream::WritePartial of the file Ap4ByteStream.cpp of the component mp42aac. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212007.

CVSS 3.1 · 7.3 High EPSS 1.5% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3668

Axiomatic Bento4 mp4edit CreateAtomFromStream memory leak

A vulnerability has been found in Axiomatic Bento4 and classified as problematic. This vulnerability affects the function AP4_AtomFactory::CreateAtomFromStream of the component mp4edit. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212008.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3669

Axiomatic Bento4 mp4edit Create memory leak

A vulnerability was found in Axiomatic Bento4 and classified as problematic. This issue affects the function AP4_AvccAtom::Create of the component mp4edit. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212009 was assigned to this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3670

Axiomatic Bento4 mp42hevc WriteSample heap-based overflow

A vulnerability was found in Axiomatic Bento4. It has been classified as critical. Affected is the function WriteSample of the component mp42hevc. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212010 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Axiosys

Products

Bento4

CVE-2022-3674

SourceCodester Sanitization Management System missing authentication

A vulnerability has been found in SourceCodester Sanitization Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to missing authentication. The attack can be launched remotely. The identifier VDB-212017 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Sanitization Management System Project

Products

Sanitization Management System

CVE-2022-3878

Maxon ERP browse_data sql injection

A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipulation of the argument tb_search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213039.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Maxonerp

Products

Maxon

CVE-2022-3955

tholum crm42 Login class.user.php sql injection

A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213461 was assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Crm42 Project

Products

Crm42

CVE-2022-3972

Pingkon HMS-PHP adminlogin.php sql injection

A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing of the file admin/adminlogin.php. The manipulation of the argument uname/pass leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213551.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Hms-php Project

Products

Hms-php

CVE-2022-3973

Pingkon HMS-PHP Data Pump Metadata admin.php sql injection

A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pump Metadata. The manipulation of the argument uname/pass leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213552.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Hms-php Project

Products

Hms-php

CVE-2022-4011

Simple History Plugin Header neutralization for logs

A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213785 was assigned to this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Simple History Project

Products

Simple History