# Vulnerabilities published in 2022 - [CVE-2022-45040](https://insights.sbomify.com/CVE-2022-45040/): Cross-site scripting in wbce:wbce cms (medium 5.4) - [CVE-2022-4504](https://insights.sbomify.com/CVE-2022-4504/): Improper Input Validation in openemr/openemr (high 7.1) - [CVE-2022-45039](https://insights.sbomify.com/CVE-2022-45039/): File upload in wbce:wbce cms (high 7.2) - [CVE-2022-45038](https://insights.sbomify.com/CVE-2022-45038/): Cross-site scripting in wbce:wbce cms (medium 5.4) - [CVE-2022-45037](https://insights.sbomify.com/CVE-2022-45037/): Cross-site scripting in wbce:wbce cms (medium 5.4) - [CVE-2022-45036](https://insights.sbomify.com/CVE-2022-45036/): Cross-site scripting in wbce:wbce cms (medium 5.4) - [CVE-2022-45033](https://insights.sbomify.com/CVE-2022-45033/): Cross-site scripting in oretnom23:expense tracker (medium 5.4) - [CVE-2022-45030](https://insights.sbomify.com/CVE-2022-45030/): SQL injection in rconfig:rconfig (high 8.8) - [CVE-2022-4503](https://insights.sbomify.com/CVE-2022-4503/): Cross-site Scripting (XSS) - Generic in openemr/openemr (medium 6.4) - [CVE-2022-45028](https://insights.sbomify.com/CVE-2022-45028/): Cross-site scripting in arris:nvg443b firmware (medium 6.1) - [CVE-2022-45027](https://insights.sbomify.com/CVE-2022-45027/): Server-side request forgery in perfsonar:perfsonar (medium 5.3) - [CVE-2022-45026](https://insights.sbomify.com/CVE-2022-45026/): Command injection in markdown preview enhanced project:markdown preview enhanced (critical 9.8) - [CVE-2022-45025](https://insights.sbomify.com/CVE-2022-45025/): Command injection in markdown preview enhanced project:markdown preview enhanced (critical 9.8) - [CVE-2022-45020](https://insights.sbomify.com/CVE-2022-45020/): Cross-site scripting in rukovoditel:rukovoditel (high 8.8) - [CVE-2022-4502](https://insights.sbomify.com/CVE-2022-4502/): Cross-site Scripting (XSS) - Reflected in openemr/openemr (high 7.3) - [CVE-2022-45019](https://insights.sbomify.com/CVE-2022-45019/): SQL injection in slims:senayan library management system (high 7.5) - [CVE-2022-45017](https://insights.sbomify.com/CVE-2022-45017/): Cross-site scripting in wbce:wbce cms (medium 4.8) - [CVE-2022-45016](https://insights.sbomify.com/CVE-2022-45016/): Cross-site scripting in wbce:wbce cms (medium 4.8) - [CVE-2022-45015](https://insights.sbomify.com/CVE-2022-45015/): Cross-site scripting in wbce:wbce cms (medium 4.8) - [CVE-2022-45014](https://insights.sbomify.com/CVE-2022-45014/): Cross-site scripting in wbce:wbce cms (medium 4.8) - [CVE-2022-45013](https://insights.sbomify.com/CVE-2022-45013/): Cross-site scripting in wbce:wbce cms (medium 4.8) - [CVE-2022-45012](https://insights.sbomify.com/CVE-2022-45012/): Cross-site scripting in wbce:wbce cms (medium 4.8) - [CVE-2022-45010](https://insights.sbomify.com/CVE-2022-45010/): SQL injection in simple phone book\/directory web app project:simple phone book\/directory web app (critical 9.8) - [CVE-2022-4501](https://insights.sbomify.com/CVE-2022-4501/): Mega Addons For WPBakery Page Builder <= 4.3.0 - Authenticated (Subscriber+) Settings Update (high 7.1) - [CVE-2022-45009](https://insights.sbomify.com/CVE-2022-45009/): File upload in online leave management system project:online leave management system (high 7.2) - [CVE-2022-45008](https://insights.sbomify.com/CVE-2022-45008/): Cross-site scripting in online leave management system project:online leave management system (medium 4.8) - [CVE-2022-45005](https://insights.sbomify.com/CVE-2022-45005/): Command injection in ip-com:ew9 firmware (critical 9.8) - [CVE-2022-45004](https://insights.sbomify.com/CVE-2022-45004/): Gophish vulnerable to Cross-site Scripting via crafted landing page (medium 6.1) - [CVE-2022-45003](https://insights.sbomify.com/CVE-2022-45003/): Gophish vulnerable to Denial of Service via crafted payload involving autofocus (high 7.5) - [CVE-2022-4499](https://insights.sbomify.com/CVE-2022-4499/): Information disclosure in Archer C5 (high 7.5) - [CVE-2022-4498](https://insights.sbomify.com/CVE-2022-4498/): Memory corruption in Archer C5 (critical 9.8) - [CVE-2022-4497](https://insights.sbomify.com/CVE-2022-4497/): Jetpack CRM < 5.5 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44962](https://insights.sbomify.com/CVE-2022-44962/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44961](https://insights.sbomify.com/CVE-2022-44961/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44960](https://insights.sbomify.com/CVE-2022-44960/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-4496](https://insights.sbomify.com/CVE-2022-4496/): miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login (medium 6.1) - [CVE-2022-44959](https://insights.sbomify.com/CVE-2022-44959/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44957](https://insights.sbomify.com/CVE-2022-44957/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44956](https://insights.sbomify.com/CVE-2022-44956/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44955](https://insights.sbomify.com/CVE-2022-44955/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44954](https://insights.sbomify.com/CVE-2022-44954/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44953](https://insights.sbomify.com/CVE-2022-44953/): Cross-site scripting in webtareas project:webtareas (medium 5.4) - [CVE-2022-44952](https://insights.sbomify.com/CVE-2022-44952/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44951](https://insights.sbomify.com/CVE-2022-44951/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44950](https://insights.sbomify.com/CVE-2022-44950/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-4495](https://insights.sbomify.com/CVE-2022-4495/): collective.dms.basecontent column.py renderCell cross site scripting (low 3.5) - [CVE-2022-44949](https://insights.sbomify.com/CVE-2022-44949/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44948](https://insights.sbomify.com/CVE-2022-44948/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44947](https://insights.sbomify.com/CVE-2022-44947/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44946](https://insights.sbomify.com/CVE-2022-44946/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44945](https://insights.sbomify.com/CVE-2022-44945/): SQL injection in rukovoditel:rukovoditel (critical 9.8) - [CVE-2022-44944](https://insights.sbomify.com/CVE-2022-44944/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4) - [CVE-2022-44942](https://insights.sbomify.com/CVE-2022-44942/): Casdoor arbitrary file deletion vulnerability via uploadFile function (high 8.1) - [CVE-2022-44940](https://insights.sbomify.com/CVE-2022-44940/): Patchelf out-of-bounds read (critical 9.1) - [CVE-2022-4494](https://insights.sbomify.com/CVE-2022-4494/): bspkrs MCPMappingViewer ZIP File RemoteZipHandler.java extractZip path traversal (medium 6.3) - [CVE-2022-44939](https://insights.sbomify.com/CVE-2022-44939/): Other in echatserver:easy chat server (high 7.8) - [CVE-2022-44938](https://insights.sbomify.com/CVE-2022-44938/): Weak cryptography in seeddms:seeddms (critical 9.8) - [CVE-2022-44937](https://insights.sbomify.com/CVE-2022-44937/): Cross-site request forgery in bosscms:bosscms (medium 6.5) - [CVE-2022-44932](https://insights.sbomify.com/CVE-2022-44932/): Missing authorization in tenda:a18 firmware (high 7.5) - [CVE-2022-44931](https://insights.sbomify.com/CVE-2022-44931/): Memory corruption in tenda:a18 firmware (high 7.5) - [CVE-2022-44930](https://insights.sbomify.com/CVE-2022-44930/): Command injection in dlink:dhp-w310av firmware (critical 9.8) - [CVE-2022-4493](https://insights.sbomify.com/CVE-2022-4493/): scifio ZIP File DefaultSampleFilesService.java downloadAndUnpackResource path traversal (medium 6.3) - [CVE-2022-44929](https://insights.sbomify.com/CVE-2022-44929/): Missing authorization in d-link:dvg-g5402sp firmware (critical 9.8) - [CVE-2022-44928](https://insights.sbomify.com/CVE-2022-44928/): Command injection in d-link:dvg-g5402sp firmware (critical 9.8) - [CVE-2022-4492](https://insights.sbomify.com/CVE-2022-4492/): Undertow client not checking server identity presented by server certificate in https connections (high 7.5) - [CVE-2022-44910](https://insights.sbomify.com/CVE-2022-44910/): Memory corruption in quarkslab:binbloom (high 7.8) - [CVE-2022-4491](https://insights.sbomify.com/CVE-2022-4491/): WP Table Reloaded <= 1.9.4 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44900](https://insights.sbomify.com/CVE-2022-44900/): py7zr directory traversal vulnerability (critical 9.1) - [CVE-2022-44898](https://insights.sbomify.com/CVE-2022-44898/): Memory corruption in asus:aura sync (high 7.8) - [CVE-2022-44897](https://insights.sbomify.com/CVE-2022-44897/): Cross-site scripting in apollotheme:ap pagebuilder (medium 6.1) - [CVE-2022-4489](https://insights.sbomify.com/CVE-2022-4489/): WOOF - Products Filter for WooCommerce < 1.3.2 - Admin+ PHP Object Injection (high 7.2) - [CVE-2022-4488](https://insights.sbomify.com/CVE-2022-4488/): Widgets on Pages < 1.8.0 - Contributor+ Stored XSS (medium 6.8) - [CVE-2022-44877](https://insights.sbomify.com/CVE-2022-44877/): CWP Control Web Panel OS Command Injection (critical 9.8, exploited in the wild) - [CVE-2022-44875](https://insights.sbomify.com/CVE-2022-44875/): Privilege escalation in kioware:kioware (medium 5.4) - [CVE-2022-44874](https://insights.sbomify.com/CVE-2022-44874/): Memory corruption in wasm3 project:wasm3 (medium 5.5) - [CVE-2022-44870](https://insights.sbomify.com/CVE-2022-44870/): Cross-site scripting in maccms:maccms (medium 6.1) - [CVE-2022-4487](https://insights.sbomify.com/CVE-2022-4487/): Easy Accordion < 2.2.0 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44860](https://insights.sbomify.com/CVE-2022-44860/): SQL injection in automotive shop management system project:automotive shop management system (high 7.2) - [CVE-2022-4486](https://insights.sbomify.com/CVE-2022-4486/): Meteor Slides < 1.5.7 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44859](https://insights.sbomify.com/CVE-2022-44859/): SQL injection in automotive shop management system project:automotive shop management system (high 7.2) - [CVE-2022-44858](https://insights.sbomify.com/CVE-2022-44858/): SQL injection in automotive shop management system project:automotive shop management system (high 7.2) - [CVE-2022-4485](https://insights.sbomify.com/CVE-2022-4485/): Page-list < 5.3 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44849](https://insights.sbomify.com/CVE-2022-44849/): Cross-site request forgery in metinfo:metinfo (high 8.8) - [CVE-2022-44844](https://insights.sbomify.com/CVE-2022-44844/): Command injection in totolink:a7100ru firmware (critical 9.8) - [CVE-2022-44843](https://insights.sbomify.com/CVE-2022-44843/): Command injection in totolink:a7100ru firmware (critical 9.8) - [CVE-2022-44840](https://insights.sbomify.com/CVE-2022-44840/): Memory corruption in gnu:binutils (high 7.8) - [CVE-2022-4484](https://insights.sbomify.com/CVE-2022-4484/): Super Socializer < 7.13.44 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44838](https://insights.sbomify.com/CVE-2022-44838/): SQL injection in automotive shop management system project:automotive shop management system (high 7.2) - [CVE-2022-44832](https://insights.sbomify.com/CVE-2022-44832/): Command injection in dlink:dir-3040 firmware (critical 9.8) - [CVE-2022-44830](https://insights.sbomify.com/CVE-2022-44830/): Code injection in event registration application project:event registration application (high 7.8) - [CVE-2022-4483](https://insights.sbomify.com/CVE-2022-4483/): Insert Pages < 3.7.5 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44820](https://insights.sbomify.com/CVE-2022-44820/): SQL injection in automotive shop management system project:automotive shop management system (high 7.2) - [CVE-2022-4482](https://insights.sbomify.com/CVE-2022-4482/): Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-4481](https://insights.sbomify.com/CVE-2022-4481/): Mesmerize Companion < 1.6.135 - Contributor+ Stored XSS (medium 5.4) - [CVE-2022-44808](https://insights.sbomify.com/CVE-2022-44808/): Command injection in dlink:dir-823g firmware (critical 9.8) - [CVE-2022-44807](https://insights.sbomify.com/CVE-2022-44807/): Memory corruption in dlink:dir-882 firmware (critical 9.8) - [CVE-2022-44806](https://insights.sbomify.com/CVE-2022-44806/): Memory corruption in dlink:dir-882 firmware (critical 9.8) - [CVE-2022-44804](https://insights.sbomify.com/CVE-2022-44804/): Memory corruption in dlink:dir-882 firmware (critical 9.8) - [CVE-2022-44801](https://insights.sbomify.com/CVE-2022-44801/): Missing authorization in dlink:dir-878 firmware (critical 9.8) - [CVE-2022-4480](https://insights.sbomify.com/CVE-2022-4480/): Click to Chat < 3.18.1 - Contributor+ Stored XSS (medium 5.4) --- From sbomify Insights: https://insights.sbomify.com/years/2022/page/217/