# Vulnerabilities published in 2022


- [CVE-2022-4155](https://insights.sbomify.com/CVE-2022-4155/): Contest Gallery < 19.1.5 - Admin+ SQL Injection (medium 4.9)
- [CVE-2022-41547](https://insights.sbomify.com/CVE-2022-41547/): MobSF allows attackers to read arbitrary files via a crafted HTTP request (high 7.5)
- [CVE-2022-41545](https://insights.sbomify.com/CVE-2022-41545/): Weak cryptography in netgear:c7800 firmware (medium 6.4)
- [CVE-2022-41544](https://insights.sbomify.com/CVE-2022-41544/): Code injection in get-simple:getsimple cms (high 8.8)
- [CVE-2022-41542](https://insights.sbomify.com/CVE-2022-41542/): Auth bypass in devhubapp:devhub (medium 5.4)
- [CVE-2022-41541](https://insights.sbomify.com/CVE-2022-41541/): Auth bypass in tp-link:ax10 firmware (high 8.1)
- [CVE-2022-41540](https://insights.sbomify.com/CVE-2022-41540/): Hardcoded credentials in tp-link:ax10 firmware (medium 5.9)
- [CVE-2022-4154](https://insights.sbomify.com/CVE-2022-4154/): Contest Gallery Pro < 19.1.5 - Admin+ SQL Injection (medium 4.9)
- [CVE-2022-41539](https://insights.sbomify.com/CVE-2022-41539/): File upload in wedding planner project:wedding planner (high 8.8)
- [CVE-2022-41538](https://insights.sbomify.com/CVE-2022-41538/): File upload in wedding planner project:wedding planner (high 8.8)
- [CVE-2022-41537](https://insights.sbomify.com/CVE-2022-41537/): File upload in online tours \& travels management system project:online tours \& travels management system (high 7.2)
- [CVE-2022-41536](https://insights.sbomify.com/CVE-2022-41536/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-41535](https://insights.sbomify.com/CVE-2022-41535/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-41534](https://insights.sbomify.com/CVE-2022-41534/): File upload in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-41533](https://insights.sbomify.com/CVE-2022-41533/): File upload in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-41532](https://insights.sbomify.com/CVE-2022-41532/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-41530](https://insights.sbomify.com/CVE-2022-41530/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-4153](https://insights.sbomify.com/CVE-2022-4153/): Contest Gallery < 19.1.5.1 - Author+ SQL Injection (medium 6.5)
- [CVE-2022-41528](https://insights.sbomify.com/CVE-2022-41528/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41527](https://insights.sbomify.com/CVE-2022-41527/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41526](https://insights.sbomify.com/CVE-2022-41526/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41525](https://insights.sbomify.com/CVE-2022-41525/): Command injection in totolink:nr1800x firmware (critical 9.8)
- [CVE-2022-41524](https://insights.sbomify.com/CVE-2022-41524/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41523](https://insights.sbomify.com/CVE-2022-41523/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41522](https://insights.sbomify.com/CVE-2022-41522/): Memory corruption in totolink:nr1800x firmware (critical 9.8)
- [CVE-2022-41521](https://insights.sbomify.com/CVE-2022-41521/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41520](https://insights.sbomify.com/CVE-2022-41520/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-4152](https://insights.sbomify.com/CVE-2022-4152/): Contest Gallery < 19.1.5 - Author+ SQL Injection (medium 6.5)
- [CVE-2022-41518](https://insights.sbomify.com/CVE-2022-41518/): Command injection in totolink:nr1800x firmware (critical 9.8)
- [CVE-2022-41517](https://insights.sbomify.com/CVE-2022-41517/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2022-41515](https://insights.sbomify.com/CVE-2022-41515/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-41514](https://insights.sbomify.com/CVE-2022-41514/): SQL injection in open source sacco management system project:open source sacco management system (high 7.2)
- [CVE-2022-41513](https://insights.sbomify.com/CVE-2022-41513/): SQL injection in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-41512](https://insights.sbomify.com/CVE-2022-41512/): File upload in online diagnostic lab management system project:online diagnostic lab management system (high 7.2)
- [CVE-2022-4151](https://insights.sbomify.com/CVE-2022-4151/): Contest Gallery < 19.1.5 - Admin+ SQL Injection (medium 6.5)
- [CVE-2022-41505](https://insights.sbomify.com/CVE-2022-41505/): Auth bypass in tp-link:tapo c200 v1 firmware (medium 6.4)
- [CVE-2022-41504](https://insights.sbomify.com/CVE-2022-41504/): File upload in billing system project:billing system (high 7.2)
- [CVE-2022-41500](https://insights.sbomify.com/CVE-2022-41500/): Cross-site request forgery in eyoucms:eyoucms (high 8.8)
- [CVE-2022-4150](https://insights.sbomify.com/CVE-2022-4150/): Contest Gallery < 19.1.5 - Author+ SQL Injection (medium 6.5)
- [CVE-2022-41498](https://insights.sbomify.com/CVE-2022-41498/): SQL injection in billing system project:billing system (high 7.2)
- [CVE-2022-41497](https://insights.sbomify.com/CVE-2022-41497/): Server-side request forgery in clippercms:clippercms (critical 9.8)
- [CVE-2022-41496](https://insights.sbomify.com/CVE-2022-41496/): Server-side request forgery in idreamsoft:icms (critical 9.8)
- [CVE-2022-41495](https://insights.sbomify.com/CVE-2022-41495/): Server-side request forgery in clippercms:clippercms (critical 9.8)
- [CVE-2022-4149](https://insights.sbomify.com/CVE-2022-4149/): Local privilege escalation using log file (high 7.0)
- [CVE-2022-41489](https://insights.sbomify.com/CVE-2022-41489/): Cross-site request forgery in wayos:lq-04 firmware (high 8.1)
- [CVE-2022-41485](https://insights.sbomify.com/CVE-2022-41485/): Memory corruption in tenda:ac6 firmware (high 7.5)
- [CVE-2022-41484](https://insights.sbomify.com/CVE-2022-41484/): Memory corruption in tenda:ap500v1 firmware (high 7.5)
- [CVE-2022-41483](https://insights.sbomify.com/CVE-2022-41483/): Memory corruption in tenda:ac6v2.0 firmware (high 7.5)
- [CVE-2022-41482](https://insights.sbomify.com/CVE-2022-41482/): Memory corruption in tenda:ac6v2.0 firmware (high 7.5)
- [CVE-2022-41481](https://insights.sbomify.com/CVE-2022-41481/): Memory corruption in tenda:ac6v2.0 firmware (high 7.5)
- [CVE-2022-41480](https://insights.sbomify.com/CVE-2022-41480/): Memory corruption in tenda:ac6v2.0 firmware (high 7.5)
- [CVE-2022-4148](https://insights.sbomify.com/CVE-2022-4148/): WP OAuth Server < 4.3.0 - Subscriber+ Arbitrary Client Deletion (medium 4.3)
- [CVE-2022-41479](https://insights.sbomify.com/CVE-2022-41479/): Missing authorization in devexpress:asp.net web forms controls (high 7.5)
- [CVE-2022-41477](https://insights.sbomify.com/CVE-2022-41477/): Server-side request forgery in webidsupport:webid (critical 9.1)
- [CVE-2022-41475](https://insights.sbomify.com/CVE-2022-41475/): Cross-site request forgery in rpcms:rpcms (high 8.8)
- [CVE-2022-41474](https://insights.sbomify.com/CVE-2022-41474/): Cross-site request forgery in rpcms:rpcms (medium 6.5)
- [CVE-2022-41473](https://insights.sbomify.com/CVE-2022-41473/): Cross-site scripting in rpcms:rpcms (medium 6.1)
- [CVE-2022-41472](https://insights.sbomify.com/CVE-2022-41472/): Cross-site scripting in 74cms:74cmsse (medium 5.4)
- [CVE-2022-41471](https://insights.sbomify.com/CVE-2022-41471/): Privilege escalation in 74cms:74cmsse (medium 6.5)
- [CVE-2022-4147](https://insights.sbomify.com/CVE-2022-4147/): Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed (high 7.5)
- [CVE-2022-4146](https://insights.sbomify.com/CVE-2022-4146/): EL Injection Vulnerability in Hitachi Replication Manager (high 7.3)
- [CVE-2022-4145](https://insights.sbomify.com/CVE-2022-4145/): Content spoofing (medium 4.3)
- [CVE-2022-41446](https://insights.sbomify.com/CVE-2022-41446/): Missing authorization in record management system project:record management system (medium 5.4)
- [CVE-2022-41445](https://insights.sbomify.com/CVE-2022-41445/): Cross-site scripting in teacher record management system project:teacher record management system (medium 4.8)
- [CVE-2022-41444](https://insights.sbomify.com/CVE-2022-41444/): Cross-site scripting in cacti:cacti (medium 6.1)
- [CVE-2022-41443](https://insights.sbomify.com/CVE-2022-41443/): Other in phpipam:phpipam (critical 9.8)
- [CVE-2022-41442](https://insights.sbomify.com/CVE-2022-41442/): Cross-site scripting in picuploader project:picuploader (medium 6.1)
- [CVE-2022-41441](https://insights.sbomify.com/CVE-2022-41441/): Cross-site scripting in reqlogic:reqlogic (medium 6.1)
- [CVE-2022-41440](https://insights.sbomify.com/CVE-2022-41440/): SQL injection in billing system project project:billing system project (high 7.2)
- [CVE-2022-4144](https://insights.sbomify.com/CVE-2022-4144/): Memory corruption in QEMU (QXL device) (medium 6.5)
- [CVE-2022-41439](https://insights.sbomify.com/CVE-2022-41439/): SQL injection in billing system project project:billing system project (high 7.2)
- [CVE-2022-41437](https://insights.sbomify.com/CVE-2022-41437/): File upload in billing system project project:billing system project (high 7.2)
- [CVE-2022-41436](https://insights.sbomify.com/CVE-2022-41436/): Auth bypass in oxhoo:tp50 firmware (critical 9.1)
- [CVE-2022-41435](https://insights.sbomify.com/CVE-2022-41435/): Cross-site scripting in openwrt:luci (medium 5.4)
- [CVE-2022-41434](https://insights.sbomify.com/CVE-2022-41434/): Cross-site scripting in eyesofnetwork:web interface (medium 6.1)
- [CVE-2022-41433](https://insights.sbomify.com/CVE-2022-41433/): Cross-site scripting in eyesofnetwork:web interface (medium 4.8)
- [CVE-2022-41432](https://insights.sbomify.com/CVE-2022-41432/): Cross-site scripting in eyesofnetwork:web interface (medium 4.8)
- [CVE-2022-41431](https://insights.sbomify.com/CVE-2022-41431/): Cross-site scripting in mindskip:xzs (medium 5.4)
- [CVE-2022-41430](https://insights.sbomify.com/CVE-2022-41430/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2022-4143](https://insights.sbomify.com/CVE-2022-4143/): Race condition in GitLab (medium 6.4)
- [CVE-2022-41429](https://insights.sbomify.com/CVE-2022-41429/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2022-41428](https://insights.sbomify.com/CVE-2022-41428/): Memory corruption in axiosys:bento4 (high 8.8)
- [CVE-2022-41427](https://insights.sbomify.com/CVE-2022-41427/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-41426](https://insights.sbomify.com/CVE-2022-41426/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-41425](https://insights.sbomify.com/CVE-2022-41425/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-41424](https://insights.sbomify.com/CVE-2022-41424/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-41423](https://insights.sbomify.com/CVE-2022-41423/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2022-41420](https://insights.sbomify.com/CVE-2022-41420/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2022-4142](https://insights.sbomify.com/CVE-2022-4142/): WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2022-41419](https://insights.sbomify.com/CVE-2022-41419/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2022-41418](https://insights.sbomify.com/CVE-2022-41418/): File upload in blogengine:blogengine.net (high 7.2)
- [CVE-2022-41417](https://insights.sbomify.com/CVE-2022-41417/): Missing authorization in blogengine:blogengine.net (critical 9.8)
- [CVE-2022-41416](https://insights.sbomify.com/CVE-2022-41416/): SQL injection in online tours \& travels management system project:online tours \& travels management system (high 7.2)
- [CVE-2022-41415](https://insights.sbomify.com/CVE-2022-41415/): Memory corruption in acer:altos w2000h-w570h f4 firmware (critical 9.8)
- [CVE-2022-41414](https://insights.sbomify.com/CVE-2022-41414/): Liferay Portal Insecure Default Configuration in auth.login.prompt.enabled (medium 5.3)
- [CVE-2022-41413](https://insights.sbomify.com/CVE-2022-41413/): Cross-site request forgery in perfsonar:perfsonar (medium 4.3)
- [CVE-2022-41412](https://insights.sbomify.com/CVE-2022-41412/): Server-side request forgery in perfsonar:perfsonar (high 8.6)
- [CVE-2022-4141](https://insights.sbomify.com/CVE-2022-4141/): Heap-based Buffer Overflow in vim/vim (high 7.3)
- [CVE-2022-41409](https://insights.sbomify.com/CVE-2022-41409/): Integer overflow in pcre:pcre2 (high 7.5)
- [CVE-2022-41408](https://insights.sbomify.com/CVE-2022-41408/): SQL injection in online pet shop we app project:online pet shop we app (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/242/