# Vulnerabilities published in 2022


- [CVE-2022-40969](https://insights.sbomify.com/CVE-2022-40969/): Command injection in QUARTZ-GOLD (high 7.2)
- [CVE-2022-40968](https://insights.sbomify.com/CVE-2022-40968/): WordPress 2kb Amazon Affiliates Store Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (medium 4.8)
- [CVE-2022-40967](https://insights.sbomify.com/CVE-2022-40967/): Delta Electronics DIAEnergie (high 8.8)
- [CVE-2022-40966](https://insights.sbomify.com/CVE-2022-40966/): Auth bypass in Buffalo network devices (high 8.8)
- [CVE-2022-40965](https://insights.sbomify.com/CVE-2022-40965/): Delta Electronics DIAEnergie (high 8.7)
- [CVE-2022-40964](https://insights.sbomify.com/CVE-2022-40964/): Privilege escalation in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software (high 7.9)
- [CVE-2022-40963](https://insights.sbomify.com/CVE-2022-40963/): WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (medium 4.8)
- [CVE-2022-40962](https://insights.sbomify.com/CVE-2022-40962/): Memory corruption in Firefox (high 8.8)
- [CVE-2022-40961](https://insights.sbomify.com/CVE-2022-40961/): Memory corruption in Firefox (medium 6.5)
- [CVE-2022-40960](https://insights.sbomify.com/CVE-2022-40960/): Use after free in Firefox (medium 6.5)
- [CVE-2022-4096](https://insights.sbomify.com/CVE-2022-4096/): Server-Side Request Forgery (SSRF) in appsmithorg/appsmith (high 8.8)
- [CVE-2022-40959](https://insights.sbomify.com/CVE-2022-40959/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-40958](https://insights.sbomify.com/CVE-2022-40958/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2022-40957](https://insights.sbomify.com/CVE-2022-40957/): Memory corruption in Firefox (medium 6.5)
- [CVE-2022-40956](https://insights.sbomify.com/CVE-2022-40956/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2022-40955](https://insights.sbomify.com/CVE-2022-40955/): Deserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBC (high 8.8)
- [CVE-2022-40954](https://insights.sbomify.com/CVE-2022-40954/): Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files (medium 5.5)
- [CVE-2022-4095](https://insights.sbomify.com/CVE-2022-4095/): Use after free in Kernel (high 7.8)
- [CVE-2022-40946](https://insights.sbomify.com/CVE-2022-40946/): Denial of service in dlink:dir-819 firmware (high 7.5)
- [CVE-2022-40944](https://insights.sbomify.com/CVE-2022-40944/): SQL injection in phpgurukul:dairy farm shop management system (critical 9.8)
- [CVE-2022-40943](https://insights.sbomify.com/CVE-2022-40943/): SQL injection in phpgurukul:dairy farm shop management system (critical 9.8)
- [CVE-2022-40942](https://insights.sbomify.com/CVE-2022-40942/): Memory corruption in tenda:tx3 firmware (critical 9.8)
- [CVE-2022-40939](https://insights.sbomify.com/CVE-2022-40939/): Information disclosure in secu:secustation firmware (medium 4.9)
- [CVE-2022-40935](https://insights.sbomify.com/CVE-2022-40935/): SQL injection in online pet shop web application project:online pet shop web application (high 7.2)
- [CVE-2022-40934](https://insights.sbomify.com/CVE-2022-40934/): SQL injection in online pet shop web application project:online pet shop web application (high 7.2)
- [CVE-2022-40933](https://insights.sbomify.com/CVE-2022-40933/): SQL injection in online pet shop web application project:online pet shop web application (high 7.2)
- [CVE-2022-40932](https://insights.sbomify.com/CVE-2022-40932/): File upload in phpgurukul:zoo management system (high 7.2)
- [CVE-2022-40931](https://insights.sbomify.com/CVE-2022-40931/): Dutchoders transfer.sh contains an XSS vulnerability via malicious file upload (medium 6.1)
- [CVE-2022-4093](https://insights.sbomify.com/CVE-2022-4093/): SQL Injection in dolibarr/dolibarr (high 8.1)
- [CVE-2022-40929](https://insights.sbomify.com/CVE-2022-40929/): XXL-JOB contains a Command execution vulnerability in background tasks (critical 9.8)
- [CVE-2022-40928](https://insights.sbomify.com/CVE-2022-40928/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-40927](https://insights.sbomify.com/CVE-2022-40927/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-40926](https://insights.sbomify.com/CVE-2022-40926/): SQL injection in online leave management system project:online leave management system (high 7.2)
- [CVE-2022-40925](https://insights.sbomify.com/CVE-2022-40925/): File upload in phpgurukul:zoo management system (high 7.2)
- [CVE-2022-40924](https://insights.sbomify.com/CVE-2022-40924/): File upload in phpgurukul:zoo management system (high 7.2)
- [CVE-2022-40923](https://insights.sbomify.com/CVE-2022-40923/): LIEF vulnerable to denial of service through segmentation fault (medium 6.5)
- [CVE-2022-40922](https://insights.sbomify.com/CVE-2022-40922/): LIEF vulnerable to denial of service through segmentation fault (medium 6.5)
- [CVE-2022-40921](https://insights.sbomify.com/CVE-2022-40921/): File upload in dedecms:dedecms (high 7.2)
- [CVE-2022-4092](https://insights.sbomify.com/CVE-2022-4092/): Cross-site scripting in GitLab (medium 5.7)
- [CVE-2022-40918](https://insights.sbomify.com/CVE-2022-40918/): Memory corruption in force1rc:discovery wifi u818a hd\+ fpv firmware (critical 9.8)
- [CVE-2022-40916](https://insights.sbomify.com/CVE-2022-40916/): Auth bypass in prasathmani:tiny file manager (critical 9.8)
- [CVE-2022-40912](https://insights.sbomify.com/CVE-2022-40912/): Cross-site scripting in etaplighting:etap safety manager (medium 6.1)
- [CVE-2022-4091](https://insights.sbomify.com/CVE-2022-4091/): SourceCodester Canteen Management System food.php query cross site scripting (low 3.5)
- [CVE-2022-40903](https://insights.sbomify.com/CVE-2022-40903/): Auth bypass in aiphone:gt-db-vn firmware (medium 6.5)
- [CVE-2022-4090](https://insights.sbomify.com/CVE-2022-4090/): rickxy Stock Management System cross-site request forgery (medium 4.3)
- [CVE-2022-40899](https://insights.sbomify.com/CVE-2022-40899/): Python Charmers Future denial of service vulnerability (high 7.5)
- [CVE-2022-40898](https://insights.sbomify.com/CVE-2022-40898/): pypa/wheel vulnerable to Regular Expression denial of service (ReDoS) (high 7.5)
- [CVE-2022-40897](https://insights.sbomify.com/CVE-2022-40897/): pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS) (medium 5.9)
- [CVE-2022-40896](https://insights.sbomify.com/CVE-2022-40896/): Pygments vulnerable to ReDoS (medium 5.5)
- [CVE-2022-40895](https://insights.sbomify.com/CVE-2022-40895/): Information disclosure in nedi:nedi (critical 9.1)
- [CVE-2022-40890](https://insights.sbomify.com/CVE-2022-40890/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2022-4089](https://insights.sbomify.com/CVE-2022-4089/): rickxy Stock Management System processlogin.php cross site scripting (medium 4.3)
- [CVE-2022-40889](https://insights.sbomify.com/CVE-2022-40889/): Deserialization in phpok:phpok (critical 9.8)
- [CVE-2022-40887](https://insights.sbomify.com/CVE-2022-40887/): SQL injection in best student result management system project:best student result management system (critical 9.8)
- [CVE-2022-40886](https://insights.sbomify.com/CVE-2022-40886/): File upload in dedecms:dedecms (high 7.2)
- [CVE-2022-40885](https://insights.sbomify.com/CVE-2022-40885/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-40884](https://insights.sbomify.com/CVE-2022-40884/): Denial of service in axiosys:bento4 (medium 5.5)
- [CVE-2022-40881](https://insights.sbomify.com/CVE-2022-40881/): Command injection in contec:solarview compact firmware (critical 9.8)
- [CVE-2022-4088](https://insights.sbomify.com/CVE-2022-4088/): rickxy Stock Management System processlogin.php sql injection (high 7.3)
- [CVE-2022-40879](https://insights.sbomify.com/CVE-2022-40879/): Cross-site scripting in keking:kkfileview (medium 6.1)
- [CVE-2022-40878](https://insights.sbomify.com/CVE-2022-40878/): File upload in exam reviewer management system project:exam reviewer management system (high 8.8)
- [CVE-2022-40877](https://insights.sbomify.com/CVE-2022-40877/): SQL injection in exam reviewer management system project:exam reviewer management system (critical 9.8)
- [CVE-2022-40876](https://insights.sbomify.com/CVE-2022-40876/): Memory corruption in tenda:ax1803 firmware (critical 9.8)
- [CVE-2022-40875](https://insights.sbomify.com/CVE-2022-40875/): Memory corruption in tenda:ax1803 firmware (high 7.5)
- [CVE-2022-40874](https://insights.sbomify.com/CVE-2022-40874/): Memory corruption in tenda:ax1803 firmware (high 7.5)
- [CVE-2022-40872](https://insights.sbomify.com/CVE-2022-40872/): SQL injection in simple e-learning system project:simple e-learning system (critical 9.8)
- [CVE-2022-40871](https://insights.sbomify.com/CVE-2022-40871/): Dolibarr vulnerable to Eval Injection (critical 9.8)
- [CVE-2022-40870](https://insights.sbomify.com/CVE-2022-40870/): Command injection in parallels:remote application server (high 8.1)
- [CVE-2022-4087](https://insights.sbomify.com/CVE-2022-4087/): iPXE TLS tls.c tls_new_ciphertext information exposure (low 2.6)
- [CVE-2022-40869](https://insights.sbomify.com/CVE-2022-40869/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-40868](https://insights.sbomify.com/CVE-2022-40868/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2022-40867](https://insights.sbomify.com/CVE-2022-40867/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2022-40866](https://insights.sbomify.com/CVE-2022-40866/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2022-40865](https://insights.sbomify.com/CVE-2022-40865/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-40864](https://insights.sbomify.com/CVE-2022-40864/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-40862](https://insights.sbomify.com/CVE-2022-40862/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-40861](https://insights.sbomify.com/CVE-2022-40861/): Memory corruption in tenda:ac18 firmware (high 7.2)
- [CVE-2022-40860](https://insights.sbomify.com/CVE-2022-40860/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-40855](https://insights.sbomify.com/CVE-2022-40855/): Memory corruption in tenda:w20e firmware (critical 9.8)
- [CVE-2022-40854](https://insights.sbomify.com/CVE-2022-40854/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2022-40853](https://insights.sbomify.com/CVE-2022-40853/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2022-40851](https://insights.sbomify.com/CVE-2022-40851/): Memory corruption in tenda:ac15 firmware (critical 9.8)
- [CVE-2022-40849](https://insights.sbomify.com/CVE-2022-40849/): ThinkCMF Stored Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2022-40847](https://insights.sbomify.com/CVE-2022-40847/): Command injection in tenda:w15e firmware (high 7.8)
- [CVE-2022-40846](https://insights.sbomify.com/CVE-2022-40846/): Cross-site scripting in tenda:w15e firmware (medium 4.8)
- [CVE-2022-40845](https://insights.sbomify.com/CVE-2022-40845/): Information disclosure in tenda:w15e firmware (medium 6.5)
- [CVE-2022-40844](https://insights.sbomify.com/CVE-2022-40844/): Cross-site scripting in tenda:w15e firmware (medium 5.4)
- [CVE-2022-40843](https://insights.sbomify.com/CVE-2022-40843/): Auth bypass in tenda:w15e firmware (medium 4.9)
- [CVE-2022-40842](https://insights.sbomify.com/CVE-2022-40842/): Server-side request forgery in ndk-design:ndkadvancedcustomizationfields (critical 9.1)
- [CVE-2022-40841](https://insights.sbomify.com/CVE-2022-40841/): Cross-site scripting in ndk-design:ndkadvancedcustomizationfields (medium 6.1)
- [CVE-2022-40840](https://insights.sbomify.com/CVE-2022-40840/): Cross-site scripting in ndk-design:ndkadvancedcustomizationfields (medium 6.1)
- [CVE-2022-40839](https://insights.sbomify.com/CVE-2022-40839/): SQL injection in ndk-design:ndkadvancedcustomizationfields (high 7.5)
- [CVE-2022-40835](https://insights.sbomify.com/CVE-2022-40835/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40834](https://insights.sbomify.com/CVE-2022-40834/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40833](https://insights.sbomify.com/CVE-2022-40833/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40832](https://insights.sbomify.com/CVE-2022-40832/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40831](https://insights.sbomify.com/CVE-2022-40831/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40830](https://insights.sbomify.com/CVE-2022-40830/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40829](https://insights.sbomify.com/CVE-2022-40829/): SQL injection in codeigniter:codeigniter (critical 9.8)
- [CVE-2022-40828](https://insights.sbomify.com/CVE-2022-40828/): SQL injection in codeigniter:codeigniter (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/247/