# Vulnerabilities published in 2022


- [CVE-2022-28522](https://insights.sbomify.com/CVE-2022-28522/): Cross-site scripting in zcms project:zcms (medium 5.4)
- [CVE-2022-28521](https://insights.sbomify.com/CVE-2022-28521/): Path traversal in zcms project:zcms (critical 9.8)
- [CVE-2022-2852](https://insights.sbomify.com/CVE-2022-2852/): Use after free in Chrome (high 8.8)
- [CVE-2022-28512](https://insights.sbomify.com/CVE-2022-28512/): SQL injection in fantastic blog project:fantastic blog (critical 9.8)
- [CVE-2022-28508](https://insights.sbomify.com/CVE-2022-28508/): MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php (medium 6.1)
- [CVE-2022-28507](https://insights.sbomify.com/CVE-2022-28507/): Cross-site scripting in bdt-121 project:bdt-121 firmware (medium 4.8)
- [CVE-2022-28506](https://insights.sbomify.com/CVE-2022-28506/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2022-28505](https://insights.sbomify.com/CVE-2022-28505/): SQL injection in jflyfox:jfinal cms (high 7.2)
- [CVE-2022-2850](https://insights.sbomify.com/CVE-2022-2850/): Null dereference in 389-ds-base (medium 6.5)
- [CVE-2022-28497](https://insights.sbomify.com/CVE-2022-28497/): Command injection in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-28496](https://insights.sbomify.com/CVE-2022-28496/): Command injection in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-28495](https://insights.sbomify.com/CVE-2022-28495/): Command injection in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-28494](https://insights.sbomify.com/CVE-2022-28494/): Command injection in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-28493](https://insights.sbomify.com/CVE-2022-28493/): Missing authorization in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-28492](https://insights.sbomify.com/CVE-2022-28492/): Auth bypass in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-28491](https://insights.sbomify.com/CVE-2022-28491/): Command injection in totolink:cp900 firmware (critical 9.8)
- [CVE-2022-2849](https://insights.sbomify.com/CVE-2022-2849/): Heap-based Buffer Overflow in vim/vim (high 7.8)
- [CVE-2022-28488](https://insights.sbomify.com/CVE-2022-28488/): Memory corruption in libwav project:libwav (high 7.5)
- [CVE-2022-28487](https://insights.sbomify.com/CVE-2022-28487/): Denial of service in broadcom:tcpreplay (high 7.5)
- [CVE-2022-28481](https://insights.sbomify.com/CVE-2022-28481/): CSV-Safe improperly filters special characters potentially leading to CSV injection (critical 9.8)
- [CVE-2022-28480](https://insights.sbomify.com/CVE-2022-28480/): Memory corruption in allmediaserver:allmediaserver (critical 9.8)
- [CVE-2022-2848](https://insights.sbomify.com/CVE-2022-2848/): Memory corruption in KEPServerEX (critical 9.1)
- [CVE-2022-28479](https://insights.sbomify.com/CVE-2022-28479/): Cross-site scripting in seeddms:seeddms (medium 4.8)
- [CVE-2022-28478](https://insights.sbomify.com/CVE-2022-28478/): Path traversal in seeddms:seeddms (medium 6.5)
- [CVE-2022-28477](https://insights.sbomify.com/CVE-2022-28477/): Cross-site scripting in wbce:wbce cms (medium 6.1)
- [CVE-2022-28471](https://insights.sbomify.com/CVE-2022-28471/): Integer overflow in rockcarry:ffjpeg (medium 6.5)
- [CVE-2022-28470](https://insights.sbomify.com/CVE-2022-28470/): Code-execution backdoor in marcador (critical 9.8)
- [CVE-2022-2847](https://insights.sbomify.com/CVE-2022-2847/): SourceCodester Guest Management System front.php sql injection (medium 6.3)
- [CVE-2022-28468](https://insights.sbomify.com/CVE-2022-28468/): SQL injection in payroll management system project:payroll management system (critical 9.8)
- [CVE-2022-28467](https://insights.sbomify.com/CVE-2022-28467/): SQL injection in online student admission project:online student admission (critical 9.8)
- [CVE-2022-28464](https://insights.sbomify.com/CVE-2022-28464/): Cross-site scripting in apifox:apifox (critical 9.0)
- [CVE-2022-28463](https://insights.sbomify.com/CVE-2022-28463/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-28462](https://insights.sbomify.com/CVE-2022-28462/): Path traversal in xxyopen:novel-plus (high 7.5)
- [CVE-2022-28461](https://insights.sbomify.com/CVE-2022-28461/): SQL injection in mingyuefusu project:mingyuefusu (critical 9.8)
- [CVE-2022-2846](https://insights.sbomify.com/CVE-2022-2846/): Calendar Event Multi View < 1.4.07 - Unauthenticated Arbitrary Event Creation to Stored XSS (medium 4.3)
- [CVE-2022-28454](https://insights.sbomify.com/CVE-2022-28454/): Cross-site scripting in limbas:limbas (medium 6.1)
- [CVE-2022-28452](https://insights.sbomify.com/CVE-2022-28452/): SQL injection in redplanetcomputers:laundry management system (critical 9.8)
- [CVE-2022-28451](https://insights.sbomify.com/CVE-2022-28451/): Path traversal in nopcommerce:nopcommerce (high 7.5)
- [CVE-2022-28450](https://insights.sbomify.com/CVE-2022-28450/): Cross-site scripting in nopcommerce:nopcommerce (medium 5.4)
- [CVE-2022-2845](https://insights.sbomify.com/CVE-2022-2845/): Improper Validation of Specified Quantity in Input in vim/vim (high 7.8)
- [CVE-2022-28449](https://insights.sbomify.com/CVE-2022-28449/): Cross-site scripting in nopcommerce:nopcommerce (medium 6.1)
- [CVE-2022-28448](https://insights.sbomify.com/CVE-2022-28448/): Cross-site scripting in nopcommerce:nopcommerce (medium 5.4)
- [CVE-2022-28445](https://insights.sbomify.com/CVE-2022-28445/): Path traversal in kitesky:kitecms (medium 6.5)
- [CVE-2022-28444](https://insights.sbomify.com/CVE-2022-28444/): Path traversal in ucms project:ucms (high 7.5)
- [CVE-2022-28443](https://insights.sbomify.com/CVE-2022-28443/): Path traversal in ucms project:ucms (critical 9.1)
- [CVE-2022-28440](https://insights.sbomify.com/CVE-2022-28440/): File upload in ucms project:ucms (high 8.8)
- [CVE-2022-2844](https://insights.sbomify.com/CVE-2022-2844/): MotoPress Timetable and Event Schedule Calendar cross site scripting (low 3.5)
- [CVE-2022-28439](https://insights.sbomify.com/CVE-2022-28439/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28438](https://insights.sbomify.com/CVE-2022-28438/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28437](https://insights.sbomify.com/CVE-2022-28437/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28436](https://insights.sbomify.com/CVE-2022-28436/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28435](https://insights.sbomify.com/CVE-2022-28435/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28434](https://insights.sbomify.com/CVE-2022-28434/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28433](https://insights.sbomify.com/CVE-2022-28433/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28432](https://insights.sbomify.com/CVE-2022-28432/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28431](https://insights.sbomify.com/CVE-2022-28431/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-2843](https://insights.sbomify.com/CVE-2022-2843/): MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting (low 3.5)
- [CVE-2022-28429](https://insights.sbomify.com/CVE-2022-28429/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28427](https://insights.sbomify.com/CVE-2022-28427/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28426](https://insights.sbomify.com/CVE-2022-28426/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28425](https://insights.sbomify.com/CVE-2022-28425/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28424](https://insights.sbomify.com/CVE-2022-28424/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28423](https://insights.sbomify.com/CVE-2022-28423/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28422](https://insights.sbomify.com/CVE-2022-28422/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28421](https://insights.sbomify.com/CVE-2022-28421/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-28420](https://insights.sbomify.com/CVE-2022-28420/): SQL injection in janobe:baby care system (critical 9.8)
- [CVE-2022-2842](https://insights.sbomify.com/CVE-2022-2842/): SourceCodester Gym Management System login.php sql injection (high 7.3)
- [CVE-2022-28417](https://insights.sbomify.com/CVE-2022-28417/): SQL injection in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-28416](https://insights.sbomify.com/CVE-2022-28416/): SQL injection in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-28415](https://insights.sbomify.com/CVE-2022-28415/): SQL injection in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-28414](https://insights.sbomify.com/CVE-2022-28414/): SQL injection in home owners collection management system project:home owners collection management system (critical 9.8)
- [CVE-2022-28413](https://insights.sbomify.com/CVE-2022-28413/): SQL injection in car driving school management system project:car driving school management system (critical 9.8)
- [CVE-2022-28412](https://insights.sbomify.com/CVE-2022-28412/): SQL injection in car driving school management system project:car driving school management system (critical 9.8)
- [CVE-2022-28411](https://insights.sbomify.com/CVE-2022-28411/): SQL injection in simple real estate portal system portal:simple real estate portal system (critical 9.8)
- [CVE-2022-28410](https://insights.sbomify.com/CVE-2022-28410/): SQL injection in simple real estate portal system project:simple real estate portal system (critical 9.8)
- [CVE-2022-2841](https://insights.sbomify.com/CVE-2022-2841/): CrowdStrike Falcon Uninstallation authorization (low 2.7)
- [CVE-2022-2840](https://insights.sbomify.com/CVE-2022-2840/): Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi (critical 9.8)
- [CVE-2022-28397](https://insights.sbomify.com/CVE-2022-28397/): Arbitrary file upload in Ghost (critical 9.8)
- [CVE-2022-28394](https://insights.sbomify.com/CVE-2022-28394/): Other in Trend Micro Password Manager (high 7.8)
- [CVE-2022-28391](https://insights.sbomify.com/CVE-2022-28391/): Command injection in busybox:busybox (high 8.8)
- [CVE-2022-28390](https://insights.sbomify.com/CVE-2022-28390/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2022-2839](https://insights.sbomify.com/CVE-2022-2839/): Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS (medium 5.4)
- [CVE-2022-28389](https://insights.sbomify.com/CVE-2022-28389/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-28388](https://insights.sbomify.com/CVE-2022-28388/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2022-28387](https://insights.sbomify.com/CVE-2022-28387/): Security feature bypass in verbatim:executive fingerprint secure ssd firmware (medium 4.6)
- [CVE-2022-28386](https://insights.sbomify.com/CVE-2022-28386/): Security feature bypass in verbatim:gd25lk01-3637-c firmware (medium 4.6)
- [CVE-2022-28385](https://insights.sbomify.com/CVE-2022-28385/): Security feature bypass in verbatim:executive fingerprint secure ssd firmware (medium 4.6)
- [CVE-2022-28384](https://insights.sbomify.com/CVE-2022-28384/): Auth bypass in verbatim:keypad secure usb 3.2 gen 1 firmware (medium 5.5)
- [CVE-2022-28383](https://insights.sbomify.com/CVE-2022-28383/): Security feature bypass in verbatim:executive fingerprint secure ssd firmware (medium 6.8)
- [CVE-2022-28382](https://insights.sbomify.com/CVE-2022-28382/): Weak cryptography in verbatim:executive fingerprint secure ssd firmware (high 7.5)
- [CVE-2022-28381](https://insights.sbomify.com/CVE-2022-28381/): Memory corruption in allmediaserver:allmediaserver (critical 9.8)
- [CVE-2022-28380](https://insights.sbomify.com/CVE-2022-28380/): Path traversal in rc-httpd project:rc-httpd (high 7.5)
- [CVE-2022-2838](https://insights.sbomify.com/CVE-2022-2838/): XML external entity in Eclipse Sphinx (medium 5.3)
- [CVE-2022-28379](https://insights.sbomify.com/CVE-2022-28379/): Cross-site scripting in nginxproxymanager:nginx proxy manager (medium 6.8)
- [CVE-2022-28378](https://insights.sbomify.com/CVE-2022-28378/): Cross-site Scripting in craftcms/cms (medium 6.1)
- [CVE-2022-28377](https://insights.sbomify.com/CVE-2022-28377/): Hardcoded credentials in verizon:lvskihp indoorunit firmware (high 7.5)
- [CVE-2022-28376](https://insights.sbomify.com/CVE-2022-28376/): Weak cryptography in verizon:lvskihp firmware (high 8.1)
- [CVE-2022-28375](https://insights.sbomify.com/CVE-2022-28375/): Command injection in verizon:lvskihp outdoorunit firmware (critical 9.8)
- [CVE-2022-28374](https://insights.sbomify.com/CVE-2022-28374/): Command injection in verizon:lvskihp outdoorunit firmware (high 8.8)
- [CVE-2022-28373](https://insights.sbomify.com/CVE-2022-28373/): Command injection in verizon:lvskihp indoorunit firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/341/