# Vulnerabilities published in 2022


- [CVE-2022-47141](https://insights.sbomify.com/CVE-2022-47141/): WordPress WP Dynamic Keywords Injector Plugin <= 2.3.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-47140](https://insights.sbomify.com/CVE-2022-47140/): WordPress ARMember Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2022-4714](https://insights.sbomify.com/CVE-2022-4714/): WP Dark Mode < 4.0.0 - Contributor+ Stored XSS in Shortcode (medium 5.4)
- [CVE-2022-47139](https://insights.sbomify.com/CVE-2022-47139/): WordPress WP Basic Elements Plugin <= 5.2.15 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2022-47138](https://insights.sbomify.com/CVE-2022-47138/): WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47137](https://insights.sbomify.com/CVE-2022-47137/): WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2022-47136](https://insights.sbomify.com/CVE-2022-47136/): WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47135](https://insights.sbomify.com/CVE-2022-47135/): WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47134](https://insights.sbomify.com/CVE-2022-47134/): WordPress Gallery Metabox Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2022-47132](https://insights.sbomify.com/CVE-2022-47132/): Cross-site request forgery in creativeitem:academy lms (high 8.8)
- [CVE-2022-47131](https://insights.sbomify.com/CVE-2022-47131/): Cross-site request forgery in creativeitem:academy lms (medium 4.8)
- [CVE-2022-47130](https://insights.sbomify.com/CVE-2022-47130/): Cross-site request forgery in creativeitem:academy lms (medium 4.3)
- [CVE-2022-47129](https://insights.sbomify.com/CVE-2022-47129/): Code injection in phpok:phpok (critical 9.8)
- [CVE-2022-47128](https://insights.sbomify.com/CVE-2022-47128/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47127](https://insights.sbomify.com/CVE-2022-47127/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47126](https://insights.sbomify.com/CVE-2022-47126/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47125](https://insights.sbomify.com/CVE-2022-47125/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47124](https://insights.sbomify.com/CVE-2022-47124/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47123](https://insights.sbomify.com/CVE-2022-47123/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47122](https://insights.sbomify.com/CVE-2022-47122/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47121](https://insights.sbomify.com/CVE-2022-47121/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47120](https://insights.sbomify.com/CVE-2022-47120/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-4712](https://insights.sbomify.com/CVE-2022-4712/): WP Cerber Security <= 9.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2022-47119](https://insights.sbomify.com/CVE-2022-47119/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47118](https://insights.sbomify.com/CVE-2022-47118/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47117](https://insights.sbomify.com/CVE-2022-47117/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47116](https://insights.sbomify.com/CVE-2022-47116/): Memory corruption in tenda:a15 firmware (high 7.5)
- [CVE-2022-47115](https://insights.sbomify.com/CVE-2022-47115/): Memory corruption in tenda:a15 firmware (critical 9.8)
- [CVE-2022-47112](https://insights.sbomify.com/CVE-2022-47112/): Other in 7-Zip (low 2.5)
- [CVE-2022-47111](https://insights.sbomify.com/CVE-2022-47111/): Other in 7-Zip (low 2.5)
- [CVE-2022-4711](https://insights.sbomify.com/CVE-2022-4711/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Menu Settings Update (medium 4.3)
- [CVE-2022-47105](https://insights.sbomify.com/CVE-2022-47105/): Jeecg-boot is vulnerable to SQL injection (critical 9.8)
- [CVE-2022-47102](https://insights.sbomify.com/CVE-2022-47102/): Cross-site scripting in phpgurukul:student study center management system (medium 5.4)
- [CVE-2022-47100](https://insights.sbomify.com/CVE-2022-47100/): Denial of service in sengled:es21-n1eaw firmware (high 7.5)
- [CVE-2022-4710](https://insights.sbomify.com/CVE-2022-4710/): Royal Elementor Addons <= 1.3.59 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2022-47095](https://insights.sbomify.com/CVE-2022-47095/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47094](https://insights.sbomify.com/CVE-2022-47094/): Null dereference in gpac:gpac (high 7.8)
- [CVE-2022-47093](https://insights.sbomify.com/CVE-2022-47093/): Use after free in gpac:gpac (high 7.8)
- [CVE-2022-47092](https://insights.sbomify.com/CVE-2022-47092/): Integer overflow in gpac:gpac (high 7.1)
- [CVE-2022-47091](https://insights.sbomify.com/CVE-2022-47091/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47090](https://insights.sbomify.com/CVE-2022-47090/): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check (high 7.8)
- [CVE-2022-4709](https://insights.sbomify.com/CVE-2022-4709/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Kit Import (medium 4.3)
- [CVE-2022-47089](https://insights.sbomify.com/CVE-2022-47089/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47088](https://insights.sbomify.com/CVE-2022-47088/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47087](https://insights.sbomify.com/CVE-2022-47087/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-47086](https://insights.sbomify.com/CVE-2022-47086/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-47085](https://insights.sbomify.com/CVE-2022-47085/): libostree vulnerable to denial of service attack (high 7.5)
- [CVE-2022-47083](https://insights.sbomify.com/CVE-2022-47083/): Deserialization in spitfire project:spitfire (high 8.8)
- [CVE-2022-4708](https://insights.sbomify.com/CVE-2022-4708/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Conditions Modification (medium 4.3)
- [CVE-2022-47076](https://insights.sbomify.com/CVE-2022-47076/): Information disclosure in smartofficepayroll:smartoffice (high 7.5)
- [CVE-2022-47075](https://insights.sbomify.com/CVE-2022-47075/): Information disclosure in smartofficepayroll:smartoffice (high 7.5)
- [CVE-2022-47073](https://insights.sbomify.com/CVE-2022-47073/): Cross-site scripting in small crm project:small crm (medium 5.4)
- [CVE-2022-47072](https://insights.sbomify.com/CVE-2022-47072/): SQL injection in sparxsystems:enterprise architect (critical 9.8)
- [CVE-2022-47071](https://insights.sbomify.com/CVE-2022-47071/): Command injection in nvs365:nvs-365-v01 firmware (critical 9.8)
- [CVE-2022-47070](https://insights.sbomify.com/CVE-2022-47070/): Information disclosure in nvs365:nvs-365-v01 firmware (high 7.5)
- [CVE-2022-4707](https://insights.sbomify.com/CVE-2022-4707/): Royal Elementor Addons <= 1.3.59 - Cross-Site Request Forgery to Menu Template creation (medium 4.3)
- [CVE-2022-47069](https://insights.sbomify.com/CVE-2022-47069/): Memory corruption in 7-zip:p7zip (high 7.8)
- [CVE-2022-47065](https://insights.sbomify.com/CVE-2022-47065/): Memory corruption in trendnet:tew-820ap firmware (high 8.8)
- [CVE-2022-4706](https://insights.sbomify.com/CVE-2022-4706/): Genesis Columns Advanced < 2.0.4 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-47053](https://insights.sbomify.com/CVE-2022-47053/): File upload in dnnsoftware:dotnetnuke (medium 5.4)
- [CVE-2022-47052](https://insights.sbomify.com/CVE-2022-47052/): Cross-site scripting in netgear:ac1200 r6220 firmware (medium 6.1)
- [CVE-2022-4705](https://insights.sbomify.com/CVE-2022-4705/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation (medium 4.3)
- [CVE-2022-47042](https://insights.sbomify.com/CVE-2022-47042/): Arbitrary file write in net.mingsoft:ms-mcms (high 8.8)
- [CVE-2022-47040](https://insights.sbomify.com/CVE-2022-47040/): Privilege escalation in askey:rtf3505vw-n1 firmware (high 7.8)
- [CVE-2022-4704](https://insights.sbomify.com/CVE-2022-4704/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Import (medium 5.4)
- [CVE-2022-47037](https://insights.sbomify.com/CVE-2022-47037/): Information disclosure in siklu:tg firmware (high 7.5)
- [CVE-2022-47036](https://insights.sbomify.com/CVE-2022-47036/): Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. (critical 9.8)
- [CVE-2022-47035](https://insights.sbomify.com/CVE-2022-47035/): Memory corruption in dlink:dir-825 firmware (critical 9.8)
- [CVE-2022-47034](https://insights.sbomify.com/CVE-2022-47034/): Auth bypass in playsms:playsms (critical 9.8)
- [CVE-2022-4703](https://insights.sbomify.com/CVE-2022-4703/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Import Deletion (medium 4.3)
- [CVE-2022-47029](https://insights.sbomify.com/CVE-2022-47029/): Privilege escalation in actionlauncher:action launcher (high 7.8)
- [CVE-2022-47028](https://insights.sbomify.com/CVE-2022-47028/): Denial of service in actionlauncher:action launcher (medium 5.5)
- [CVE-2022-47027](https://insights.sbomify.com/CVE-2022-47027/): Path traversal in timmystudios:fast typing keyboard (critical 9.8)
- [CVE-2022-47024](https://insights.sbomify.com/CVE-2022-47024/): Null dereference in vim:vim (high 7.8)
- [CVE-2022-47022](https://insights.sbomify.com/CVE-2022-47022/): Null dereference in open-mpi:hwloc (medium 4.7)
- [CVE-2022-47021](https://insights.sbomify.com/CVE-2022-47021/): Null dereference in fedoraproject:fedora (high 7.8)
- [CVE-2022-4702](https://insights.sbomify.com/CVE-2022-4702/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Deactivation (medium 5.4)
- [CVE-2022-47015](https://insights.sbomify.com/CVE-2022-47015/): Null dereference in mariadb:mariadb (medium 6.5)
- [CVE-2022-47012](https://insights.sbomify.com/CVE-2022-47012/): Memory corruption in solarwinds:dynamips (high 7.5)
- [CVE-2022-47011](https://insights.sbomify.com/CVE-2022-47011/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2022-47010](https://insights.sbomify.com/CVE-2022-47010/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2022-4701](https://insights.sbomify.com/CVE-2022-4701/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Plugin Activation (medium 4.3)
- [CVE-2022-47008](https://insights.sbomify.com/CVE-2022-47008/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2022-47007](https://insights.sbomify.com/CVE-2022-47007/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2022-47003](https://insights.sbomify.com/CVE-2022-47003/): Auth bypass in murasoftware:mura cms (critical 9.8)
- [CVE-2022-47002](https://insights.sbomify.com/CVE-2022-47002/): Auth bypass in masacms:masacms (critical 9.8)
- [CVE-2022-4700](https://insights.sbomify.com/CVE-2022-4700/): Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Theme Activation (medium 5.4)
- [CVE-2022-46999](https://insights.sbomify.com/CVE-2022-46999/): SQL injection in tuzicms:tuzicms (critical 9.8)
- [CVE-2022-46998](https://insights.sbomify.com/CVE-2022-46998/): Server-side request forgery in taogogo:taocms (critical 9.8)
- [CVE-2022-46997](https://insights.sbomify.com/CVE-2022-46997/): Supply chain in passhunt project:passhunt (critical 9.8)
- [CVE-2022-46996](https://insights.sbomify.com/CVE-2022-46996/): Supply chain in vsphere selfuse project:vsphere selfuse (critical 9.8)
- [CVE-2022-4699](https://insights.sbomify.com/CVE-2022-4699/): MediaElement.js – HTML5 Video & Audio Player <= 4.2.8 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2022-4698](https://insights.sbomify.com/CVE-2022-4698/): ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings (medium 5.5)
- [CVE-2022-46973](https://insights.sbomify.com/CVE-2022-46973/): Server-side request forgery in anji-plus:aj-report (critical 9.8)
- [CVE-2022-4697](https://insights.sbomify.com/CVE-2022-4697/): ProfilePress <= 4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2022-46968](https://insights.sbomify.com/CVE-2022-46968/): Cross-site scripting in revenue collection system project:revenue collection system (medium 5.4)
- [CVE-2022-46967](https://insights.sbomify.com/CVE-2022-46967/): Missing authorization in revenue collection system project:revenue collection system (critical 9.8)
- [CVE-2022-46966](https://insights.sbomify.com/CVE-2022-46966/): SQL injection in revenue collection system project:revenue collection system (critical 9.8)
- [CVE-2022-46965](https://insights.sbomify.com/CVE-2022-46965/): SQL injection in 202-ecommerce:administrative mandate (high 8.1)
- [CVE-2022-4696](https://insights.sbomify.com/CVE-2022-4696/): Use after free in Linux Kernel (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/203/