Total
424978 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-37190 | 1 Cuppacms | 1 Cuppacms | 2026-06-17 | N/A | 8.8 HIGH |
| CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php. | |||||
| CVE-2022-37189 | 1 Ddmal | 1 Mei2volpiano | 2026-06-17 | N/A | 7.5 HIGH |
| DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input. | |||||
| CVE-2022-37186 | 1 Lemonldap-ng | 1 Lemonldap\ | 2026-06-17 | N/A | 5.9 MEDIUM |
| In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically. | |||||
| CVE-2022-37185 | 1 Ems Project | 1 Ems | 2026-06-17 | N/A | 7.5 HIGH |
| SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the Thai Basic Education Commission, which can lead to data leakage. | |||||
| CVE-2022-37184 | 1 Garage Management System Project | 1 Garage Management System | 2026-06-17 | N/A | 8.8 HIGH |
| The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a dangerous RCE or LCE exploit file. | |||||
| CVE-2022-37183 | 1 Piwigo | 1 Piwigo | 2026-06-17 | N/A | 6.1 MEDIUM |
| Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list. | |||||
| CVE-2022-37181 | 1 72crm | 1 Wukong Crm | 2026-06-17 | N/A | 9.8 CRITICAL |
| 72crm 9.0 has an Arbitrary file upload vulnerability. | |||||
| CVE-2022-37178 | 1 72crm | 1 Wukong Crm | 2026-06-17 | N/A | 8.8 HIGH |
| An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar. | |||||
| CVE-2022-37177 | 1 Hirevue | 1 Hiring Platform | 2026-06-17 | N/A | 7.5 HIGH |
| HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption. | |||||
| CVE-2022-37175 | 1 Tenda | 2 Ac15, Ac15 Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet. | |||||
| CVE-2022-37173 | 2 Microsoft, Vim | 2 Windows, Gvim | 2026-06-17 | N/A | 7.8 HIGH |
| An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe. | |||||
| CVE-2022-37172 | 1 Msys2 | 1 Msys2 | 2026-06-17 | N/A | 7.8 HIGH |
| Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory. | |||||
| CVE-2022-37164 | 1 Ontrack Project | 1 Ontrack | 2026-06-17 | N/A | 9.8 CRITICAL |
| Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes. | |||||
| CVE-2022-37163 | 1 Ihatetobudget Project | 1 Ihatetobudget | 2026-06-17 | N/A | 9.8 CRITICAL |
| Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes. | |||||
| CVE-2022-37162 | 1 Claroline | 1 Claroline | 2026-06-17 | N/A | 5.4 MEDIUM |
| Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event. | |||||
| CVE-2022-37161 | 1 Claroline | 1 Claroline | 2026-06-17 | N/A | 6.1 MEDIUM |
| Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload. | |||||
| CVE-2022-37160 | 1 Claroline | 1 Claroline | 2026-06-17 | N/A | 5.4 MEDIUM |
| Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user. | |||||
| CVE-2022-37159 | 1 Claroline | 1 Claroline | 2026-06-17 | N/A | 9.8 CRITICAL |
| Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload. | |||||
| CVE-2022-37158 | 1 Iocoder | 1 Ruoyi-vue-pro | 2026-06-17 | N/A | 9.8 CRITICAL |
| RuoYi v3.8.3 has a Weak password vulnerability in the management system. | |||||
| CVE-2022-37155 | 1 Spip | 1 Spip | 2026-06-17 | N/A | 8.8 HIGH |
| RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. | |||||