Total
423984 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-23881 | 1 Zzzcms | 1 Zzzphp | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. | |||||
| CVE-2022-23880 | 1 Taogogo | 1 Taocms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. | |||||
| CVE-2022-23878 | 1 Seacms | 1 Seacms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php. | |||||
| CVE-2022-23873 | 1 Victor Cms Project | 1 Victor Cms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter. | |||||
| CVE-2022-23872 | 1 Emlog | 1 Emlog | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info. | |||||
| CVE-2022-23871 | 1 Gibbonedu | 1 Gibbon | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters. | |||||
| CVE-2022-23869 | 1 Ruoyi | 1 Ruoyi | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request. | |||||
| CVE-2022-23868 | 1 Ruoyi | 1 Ruoyi | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file. | |||||
| CVE-2022-23865 | 1 Wecul | 1 Nyron | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. To exploit this vulnerability, an attacker must inject '"> on the thes1 parameter. | |||||
| CVE-2022-23863 | 1 Zohocorp | 1 Manageengine Desktop Central | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. | |||||
| CVE-2022-23862 | 1 Ysoft | 1 Safeq | 2026-06-17 | N/A | 7.8 HIGH |
| A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the vulnerability to execute arbitrary code and elevate to the system user. | |||||
| CVE-2022-23861 | 1 Ysoft | 1 Safeq | 2026-06-17 | N/A | 5.4 MEDIUM |
| Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be leveraged to perform XSS attacks on legitimate users accessing the SafeQ web interface. | |||||
| CVE-2022-23858 | 1 Starwindsoftware | 1 Command Center | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2. | |||||
| CVE-2022-23857 | 1 Navidrome | 1 Navidrome | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords). | |||||
| CVE-2022-23856 | 1 Saviynt | 1 Enterprise Identity Cloud | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI. | |||||
| CVE-2022-23855 | 1 Saviynt | 1 Enterprise Identity Cloud | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to reset passwords and login as any local account. | |||||
| CVE-2022-23854 | 1 Aveva | 1 Intouch Access Anywhere | 2026-06-17 | N/A | 7.5 HIGH |
| AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server. | |||||
| CVE-2022-23853 | 1 Kde | 2 Kate, Ktexteditor | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory. | |||||
| CVE-2022-23851 | 1 Netaxis | 1 Api Orchestrator | 2026-06-17 | N/A | 9.8 CRITICAL |
| Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI). | |||||
| CVE-2022-23850 | 1 Epub2txt Project | 1 Epub2txt | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document. | |||||