# Vulnerabilities published in 2022


- [CVE-2022-43062](https://insights.sbomify.com/CVE-2022-43062/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-43061](https://insights.sbomify.com/CVE-2022-43061/): File upload in online tours \& travels management system project:online tours \& travels management system (high 7.2)
- [CVE-2022-4306](https://insights.sbomify.com/CVE-2022-4306/): Panda Pods Repeater Field < 1.5.4 - Reflected XSS (medium 5.4)
- [CVE-2022-43058](https://insights.sbomify.com/CVE-2022-43058/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (critical 9.8)
- [CVE-2022-43052](https://insights.sbomify.com/CVE-2022-43052/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-43051](https://insights.sbomify.com/CVE-2022-43051/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-43050](https://insights.sbomify.com/CVE-2022-43050/): File upload in online tours and travels management system project:online tours and travels management system (high 7.2)
- [CVE-2022-4305](https://insights.sbomify.com/CVE-2022-4305/): Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin (critical 9.8)
- [CVE-2022-43049](https://insights.sbomify.com/CVE-2022-43049/): SQL injection in canteen management system project:canteen management system (high 7.2)
- [CVE-2022-43046](https://insights.sbomify.com/CVE-2022-43046/): Cross-site scripting in oretnom23:food ordering management system (medium 4.8)
- [CVE-2022-43045](https://insights.sbomify.com/CVE-2022-43045/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-43044](https://insights.sbomify.com/CVE-2022-43044/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-43043](https://insights.sbomify.com/CVE-2022-43043/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-43042](https://insights.sbomify.com/CVE-2022-43042/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-43040](https://insights.sbomify.com/CVE-2022-43040/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2022-4304](https://insights.sbomify.com/CVE-2022-4304/): Timing Oracle in RSA Decryption (medium 5.9)
- [CVE-2022-43039](https://insights.sbomify.com/CVE-2022-43039/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2022-43038](https://insights.sbomify.com/CVE-2022-43038/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-43037](https://insights.sbomify.com/CVE-2022-43037/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-43035](https://insights.sbomify.com/CVE-2022-43035/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-43034](https://insights.sbomify.com/CVE-2022-43034/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-43033](https://insights.sbomify.com/CVE-2022-43033/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-43032](https://insights.sbomify.com/CVE-2022-43032/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-43031](https://insights.sbomify.com/CVE-2022-43031/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2022-43030](https://insights.sbomify.com/CVE-2022-43030/): Command injection in siyucms:siyucms (high 7.2)
- [CVE-2022-4303](https://insights.sbomify.com/CVE-2022-4303/): WP Limit Login Attempts <= 2.6.4 - IP Spoofing (high 7.5)
- [CVE-2022-43029](https://insights.sbomify.com/CVE-2022-43029/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-43028](https://insights.sbomify.com/CVE-2022-43028/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-43027](https://insights.sbomify.com/CVE-2022-43027/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-43026](https://insights.sbomify.com/CVE-2022-43026/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-43025](https://insights.sbomify.com/CVE-2022-43025/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-43024](https://insights.sbomify.com/CVE-2022-43024/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-43023](https://insights.sbomify.com/CVE-2022-43023/): SQL injection in opencats:opencats (medium 6.5)
- [CVE-2022-43022](https://insights.sbomify.com/CVE-2022-43022/): SQL injection in opencats:opencats (medium 6.5)
- [CVE-2022-43021](https://insights.sbomify.com/CVE-2022-43021/): SQL injection in opencats:opencats (medium 6.5)
- [CVE-2022-43020](https://insights.sbomify.com/CVE-2022-43020/): SQL injection in opencats:opencats (medium 6.5)
- [CVE-2022-4302](https://insights.sbomify.com/CVE-2022-4302/): White Label CMS < 2.5 - Admin+ PHP Object Injection (high 7.2)
- [CVE-2022-43019](https://insights.sbomify.com/CVE-2022-43019/): Deserialization in opencats:opencats (critical 9.8)
- [CVE-2022-43018](https://insights.sbomify.com/CVE-2022-43018/): Cross-site scripting in opencats:opencats (medium 6.1)
- [CVE-2022-43017](https://insights.sbomify.com/CVE-2022-43017/): Cross-site scripting in opencats:opencats (medium 6.1)
- [CVE-2022-43016](https://insights.sbomify.com/CVE-2022-43016/): Cross-site scripting in opencats:opencats (medium 6.1)
- [CVE-2022-43015](https://insights.sbomify.com/CVE-2022-43015/): Cross-site scripting in opencats:opencats (medium 6.1)
- [CVE-2022-43014](https://insights.sbomify.com/CVE-2022-43014/): Cross-site scripting in opencats:opencats (medium 6.1)
- [CVE-2022-4301](https://insights.sbomify.com/CVE-2022-4301/): Sunshine Photo Cart < 2.9.15 - Reflected XSS (medium 6.1)
- [CVE-2022-43003](https://insights.sbomify.com/CVE-2022-43003/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-43002](https://insights.sbomify.com/CVE-2022-43002/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-43001](https://insights.sbomify.com/CVE-2022-43001/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-43000](https://insights.sbomify.com/CVE-2022-43000/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-4300](https://insights.sbomify.com/CVE-2022-4300/): FastCMS Template edit injection (medium 6.3)
- [CVE-2022-42999](https://insights.sbomify.com/CVE-2022-42999/): Command injection in dlink:dir-816 firmware (high 7.5)
- [CVE-2022-42998](https://insights.sbomify.com/CVE-2022-42998/): Memory corruption in dlink:dir-816 firmware (critical 9.8)
- [CVE-2022-42993](https://insights.sbomify.com/CVE-2022-42993/): Cross-site scripting in password storage application project:password storage application (medium 5.4)
- [CVE-2022-42992](https://insights.sbomify.com/CVE-2022-42992/): Cross-site scripting in train scheduler app project:train scheduler app (medium 5.4)
- [CVE-2022-42991](https://insights.sbomify.com/CVE-2022-42991/): Cross-site scripting in simple online public access catalog project:simple online public access catalog (medium 5.4)
- [CVE-2022-42990](https://insights.sbomify.com/CVE-2022-42990/): SQL injection in oretnom23:food ordering management system (high 7.2)
- [CVE-2022-4299](https://insights.sbomify.com/CVE-2022-4299/): Metricool < 1.18 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-42989](https://insights.sbomify.com/CVE-2022-42989/): Cross-site scripting in sankhya:sankhya om (critical 9.0)
- [CVE-2022-42985](https://insights.sbomify.com/CVE-2022-42985/): Cross-site scripting in scratch-wiki:scratch login (medium 4.8)
- [CVE-2022-42984](https://insights.sbomify.com/CVE-2022-42984/): SQL injection in wowonder:wowonder (critical 9.8)
- [CVE-2022-42983](https://insights.sbomify.com/CVE-2022-42983/): Auth bypass in anji-plus:aj-report (high 8.8)
- [CVE-2022-42982](https://insights.sbomify.com/CVE-2022-42982/): Information disclosure in bund:bkg professional ntripcaster (high 7.5)
- [CVE-2022-42980](https://insights.sbomify.com/CVE-2022-42980/): Hardcoded credentials in go-admin:go-admin (critical 9.8)
- [CVE-2022-4298](https://insights.sbomify.com/CVE-2022-4298/): Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File Download (critical 9.8)
- [CVE-2022-42979](https://insights.sbomify.com/CVE-2022-42979/): Security feature bypass in rydesharing:ryde (high 8.8)
- [CVE-2022-42978](https://insights.sbomify.com/CVE-2022-42978/): Missing authorization in atlassian:confluence data center (high 7.5)
- [CVE-2022-42977](https://insights.sbomify.com/CVE-2022-42977/): Path traversal in atlassian:confluence data center (high 7.5)
- [CVE-2022-42975](https://insights.sbomify.com/CVE-2022-42975/): Phoenix before 1.6.14 mishandles check_origin wildcarding (high 7.5)
- [CVE-2022-42974](https://insights.sbomify.com/CVE-2022-42974/): In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) a (medium 4.8)
- [CVE-2022-42973](https://insights.sbomify.com/CVE-2022-42973/): Hardcoded credentials in APC Easy UPS Online Monitoring Software (high 7.8)
- [CVE-2022-42972](https://insights.sbomify.com/CVE-2022-42972/): Misconfiguration in APC Easy UPS Online Monitoring Software (high 7.8)
- [CVE-2022-42971](https://insights.sbomify.com/CVE-2022-42971/): File upload in APC Easy UPS Online Monitoring Software (critical 9.8)
- [CVE-2022-42970](https://insights.sbomify.com/CVE-2022-42970/): Auth bypass in APC Easy UPS Online Monitoring Software (critical 9.8)
- [CVE-2022-4297](https://insights.sbomify.com/CVE-2022-4297/): WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi (critical 9.8)
- [CVE-2022-42969](https://insights.sbomify.com/CVE-2022-42969/): Denial of service in pytest:py (medium 5.3)
- [CVE-2022-42968](https://insights.sbomify.com/CVE-2022-42968/): Gitea vulnerable to Argument Injection (critical 9.8)
- [CVE-2022-42967](https://insights.sbomify.com/CVE-2022-42967/): XSS in Caret markdown editor leads to remote code execution when viewing crafted Markdown files (high 7.5)
- [CVE-2022-42966](https://insights.sbomify.com/CVE-2022-42966/): Exponential ReDoS in cleo leads to denial of service (medium 5.9)
- [CVE-2022-42965](https://insights.sbomify.com/CVE-2022-42965/): Exponential ReDoS in snowflake-connector-python leads to denial of service (low 3.7)
- [CVE-2022-42964](https://insights.sbomify.com/CVE-2022-42964/): Exponential ReDoS in pymatgen leads to denial of service (medium 5.9)
- [CVE-2022-42961](https://insights.sbomify.com/CVE-2022-42961/): Information disclosure in wolfssl:wolfssl (medium 5.3)
- [CVE-2022-42960](https://insights.sbomify.com/CVE-2022-42960/): Cross-site scripting in equalweb:equalweb accessibility widget (medium 5.4)
- [CVE-2022-4296](https://insights.sbomify.com/CVE-2022-4296/): TP-Link TL-WR740N ARP resource consumption (medium 6.5)
- [CVE-2022-42956](https://insights.sbomify.com/CVE-2022-42956/): Information disclosure in passwork:passwork (high 7.5)
- [CVE-2022-42955](https://insights.sbomify.com/CVE-2022-42955/): Information disclosure in passwork:passwork (high 7.5)
- [CVE-2022-42954](https://insights.sbomify.com/CVE-2022-42954/): Cross-site scripting in keyfactor:kefactor ejbca (medium 5.4)
- [CVE-2022-42953](https://insights.sbomify.com/CVE-2022-42953/): Information disclosure in zkteco:zem500 firmware (high 7.5)
- [CVE-2022-42951](https://insights.sbomify.com/CVE-2022-42951/): Auth bypass in couchbase:couchbase server (high 8.1)
- [CVE-2022-42950](https://insights.sbomify.com/CVE-2022-42950/): Denial of service in couchbase:couchbase server (medium 4.9)
- [CVE-2022-4295](https://insights.sbomify.com/CVE-2022-4295/): Show All Comments < 7.0.1 - Reflected XSS (medium 6.1)
- [CVE-2022-42949](https://insights.sbomify.com/CVE-2022-42949/): SilverStripe Subsite weakens file permissions (high 7.5)
- [CVE-2022-42948](https://insights.sbomify.com/CVE-2022-42948/): Fortra Cobalt Strike User Interface Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2022-42947](https://insights.sbomify.com/CVE-2022-42947/): Memory corruption in Autodesk Maya (high 7.8)
- [CVE-2022-42946](https://insights.sbomify.com/CVE-2022-42946/): Memory corruption in Autodesk Maya (high 7.1)
- [CVE-2022-42945](https://insights.sbomify.com/CVE-2022-42945/): Other in DWG TrueView (high 7.8)
- [CVE-2022-42944](https://insights.sbomify.com/CVE-2022-42944/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-42943](https://insights.sbomify.com/CVE-2022-42943/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-42942](https://insights.sbomify.com/CVE-2022-42942/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-42941](https://insights.sbomify.com/CVE-2022-42941/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-42940](https://insights.sbomify.com/CVE-2022-42940/): Memory corruption in Autodesk Design Review (high 7.8)
- [CVE-2022-4294](https://insights.sbomify.com/CVE-2022-4294/): Norton, Avira, Avast and AVG Antivirus for Windows Privilege Escalation (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/230/