Total
423922 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-23363 | 1 Online Banking System Project | 1 Online Banking System | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php. | |||||
| CVE-2022-23358 | 1 Easycms | 1 Easycms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement. | |||||
| CVE-2022-23357 | 1 Mozilo | 1 Mozilocms | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir. | |||||
| CVE-2022-23342 | 1 Hyland | 1 Onbase | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An attacker can obtain valid users based on the response returned for invalid and valid users by sending a POST login request to the /mobilebroker/ServiceToBroker.svc/Json/Connect endpoint. This can lead to user enumeration against the underlying Active Directory integrated systems. | |||||
| CVE-2022-23340 | 1 Joplin Project | 1 Joplin | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. | |||||
| CVE-2022-23337 | 1 Dedecms | 1 Dedecms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter. | |||||
| CVE-2022-23336 | 1 S-cms | 1 S-cms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter. | |||||
| CVE-2022-23335 | 1 Metinfo | 1 Metinfo | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter. | |||||
| CVE-2022-23332 | 1 Ejointech | 6 Acom508, Acom508 Firmware, Acom516 and 3 more | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 allows a remote attacker to inject arbitrary code via the field. | |||||
| CVE-2022-23331 | 1 Dataease | 1 Dataease | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password. | |||||
| CVE-2022-23330 | 1 Jpress | 1 Jpress | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package. | |||||
| CVE-2022-23329 | 1 Ujcms | 1 Jspxcms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files. | |||||
| CVE-2022-23319 | 1 Pcf2bdf Project | 1 Pcf2bdf | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash via a specially crafted PCF font file. This crash affects the availability of the software and dependent downstream components. | |||||
| CVE-2022-23318 | 1 Pcf2bdf Project | 1 Pcf2bdf | 2026-06-17 | 5.8 MEDIUM | 7.1 HIGH |
| A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows an attacker to trigger unsafe memory access via a specially crafted PCF font file. This out-of-bound read may lead to an application crash, information disclosure via program memory or other context-dependent impact. | |||||
| CVE-2022-23317 | 1 Helpsystems | 1 Cobalt Strike | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| CobaltStrike <=4.5 HTTP(S) listener does not determine whether the request URL begins with "/", and attackers can obtain relevant information by specifying the URL. | |||||
| CVE-2022-23316 | 1 Taogogo | 1 Taocms | 2026-06-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt. | |||||
| CVE-2022-23315 | 1 Mingsoft | 1 Mcms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. | |||||
| CVE-2022-23314 | 1 Mingsoft | 1 Mcms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. | |||||
| CVE-2022-23312 | 1 Siemens | 1 Spectrum Power 4 | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP9 Security Patch 1). The integrated web application "Online Help" in affected product contains a Cross-Site Scripting (XSS) vulnerability that could be exploited if unsuspecting users are tricked into accessing a malicious link. | |||||
| CVE-2022-23307 | 3 Apache, Oracle, Qos | 26 Chainsaw, Log4j, Advanced Supply Chain Planning and 23 more | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. | |||||