# Vulnerabilities published in 2022


- [CVE-2022-25601](https://insights.sbomify.com/CVE-2022-25601/): WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability (medium 4.7)
- [CVE-2022-25600](https://insights.sbomify.com/CVE-2022-25600/): WordPress WP Google Map plugin <= 4.2.3 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-2560](https://insights.sbomify.com/CVE-2022-2560/): Path traversal in CompleteFTP (high 8.2)
- [CVE-2022-25599](https://insights.sbomify.com/CVE-2022-25599/): WordPress Spiffy Calendar plugin <= 4.9.0 - Event deletion via Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2022-25598](https://insights.sbomify.com/CVE-2022-25598/): Apache DolphinScheduler user registration is vulnerable to ReDoS attacks (high 7.5)
- [CVE-2022-25597](https://insights.sbomify.com/CVE-2022-25597/): ASUS RT-AC86U - Command Injection (high 8.8)
- [CVE-2022-25596](https://insights.sbomify.com/CVE-2022-25596/): ASUS RT-AC86U - Heap-based buffer overflow (high 8.8)
- [CVE-2022-25595](https://insights.sbomify.com/CVE-2022-25595/): ASUS RT-AC86U - Improper Input Validation (medium 6.5)
- [CVE-2022-25594](https://insights.sbomify.com/CVE-2022-25594/): Microprogram parking lot management system - Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2022-25591](https://insights.sbomify.com/CVE-2022-25591/): Path traversal in blogengine:blogengine.net (critical 9.1)
- [CVE-2022-25590](https://insights.sbomify.com/CVE-2022-25590/): Auth bypass in surveyking:surveyking (medium 6.5)
- [CVE-2022-2559](https://insights.sbomify.com/CVE-2022-2559/): Fluent Support < 1.5.8 - Admin+ SQLi (high 7.2)
- [CVE-2022-25585](https://insights.sbomify.com/CVE-2022-25585/): Cross-site scripting in unioncms project:unioncms (medium 5.4)
- [CVE-2022-25584](https://insights.sbomify.com/CVE-2022-25584/): Information disclosure in flexwatch:fw3170-ps-e firmware (high 7.5)
- [CVE-2022-25582](https://insights.sbomify.com/CVE-2022-25582/): Cross-site scripting in classcms project:classcms (medium 5.4)
- [CVE-2022-25581](https://insights.sbomify.com/CVE-2022-25581/): File upload in classcms:classcms (high 7.8)
- [CVE-2022-2558](https://insights.sbomify.com/CVE-2022-2558/): Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing (medium 5.3)
- [CVE-2022-25578](https://insights.sbomify.com/CVE-2022-25578/): Code injection in taogogo:taocms (critical 9.8)
- [CVE-2022-25577](https://insights.sbomify.com/CVE-2022-25577/): Hardcoded credentials in alf-banco:alf-banco (critical 9.1)
- [CVE-2022-25576](https://insights.sbomify.com/CVE-2022-25576/): Cross-Site Request Forgery in Anchor CMS (medium 4.5)
- [CVE-2022-25575](https://insights.sbomify.com/CVE-2022-25575/): Cross-site scripting in hongmen:parking management system (medium 6.1)
- [CVE-2022-25574](https://insights.sbomify.com/CVE-2022-25574/): Cross-site scripting in douco:douphp (medium 4.8)
- [CVE-2022-25571](https://insights.sbomify.com/CVE-2022-25571/): Information disclosure in bluedon:internet access detector (high 7.5)
- [CVE-2022-25570](https://insights.sbomify.com/CVE-2022-25570/): Missing authorization in clickstudios:passwordstate (medium 6.5)
- [CVE-2022-2557](https://insights.sbomify.com/CVE-2022-2557/): WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion (high 8.8)
- [CVE-2022-25569](https://insights.sbomify.com/CVE-2022-25569/): Hardcoded credentials in bettinivideo:sgsetup (critical 9.8)
- [CVE-2022-25568](https://insights.sbomify.com/CVE-2022-25568/): MotionEye allows attackers to access sensitive information (high 7.5)
- [CVE-2022-25566](https://insights.sbomify.com/CVE-2022-25566/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25561](https://insights.sbomify.com/CVE-2022-25561/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2022-25560](https://insights.sbomify.com/CVE-2022-25560/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2022-2556](https://insights.sbomify.com/CVE-2022-2556/): MailChimp for Woocommerce < 2.7.2 - Admin+ SSRF (low 2.7)
- [CVE-2022-25558](https://insights.sbomify.com/CVE-2022-25558/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25557](https://insights.sbomify.com/CVE-2022-25557/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25556](https://insights.sbomify.com/CVE-2022-25556/): Memory corruption in tenda:ax12 firmware (high 7.5)
- [CVE-2022-25555](https://insights.sbomify.com/CVE-2022-25555/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25554](https://insights.sbomify.com/CVE-2022-25554/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25553](https://insights.sbomify.com/CVE-2022-25553/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25552](https://insights.sbomify.com/CVE-2022-25552/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25551](https://insights.sbomify.com/CVE-2022-25551/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25550](https://insights.sbomify.com/CVE-2022-25550/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-2555](https://insights.sbomify.com/CVE-2022-2555/): Yotpo Reviews for WooCommerce <= 2.0.4 - Arbitrary Settings Update via CSRF (medium 6.5)
- [CVE-2022-25549](https://insights.sbomify.com/CVE-2022-25549/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25548](https://insights.sbomify.com/CVE-2022-25548/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25547](https://insights.sbomify.com/CVE-2022-25547/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-25546](https://insights.sbomify.com/CVE-2022-25546/): Memory corruption in tenda:ax1806 firmware (high 7.5)
- [CVE-2022-2554](https://insights.sbomify.com/CVE-2022-2554/): Enable Media Replace < 4.0.0 - Admin+ Path Traversal (medium 4.9)
- [CVE-2022-2553](https://insights.sbomify.com/CVE-2022-2553/): Auth bypass in Booth (medium 6.5)
- [CVE-2022-25523](https://insights.sbomify.com/CVE-2022-25523/): Cross-site request forgery in typesettercms:typesetter (high 8.8)
- [CVE-2022-25521](https://insights.sbomify.com/CVE-2022-25521/): Hardcoded credentials in nuuo:network video recorder firmware (critical 9.8)
- [CVE-2022-2552](https://insights.sbomify.com/CVE-2022-2552/): Duplicator < 1.4.7.1 - Unauthenticated System Information Disclosure (medium 5.3)
- [CVE-2022-25518](https://insights.sbomify.com/CVE-2022-25518/): Information disclosure in tecnoteca:cmdbuild (medium 6.5)
- [CVE-2022-25517](https://insights.sbomify.com/CVE-2022-25517/): SQL injection in baomidou:mybatis-plus (critical 9.8)
- [CVE-2022-25516](https://insights.sbomify.com/CVE-2022-25516/): Memory corruption in nothings:stb truetype.h (medium 6.5)
- [CVE-2022-25515](https://insights.sbomify.com/CVE-2022-25515/): Memory corruption in nothings:stb truetype.h (medium 6.5)
- [CVE-2022-25514](https://insights.sbomify.com/CVE-2022-25514/): Memory corruption in nothings:stb truetype.h (high 7.5)
- [CVE-2022-25512](https://insights.sbomify.com/CVE-2022-25512/): Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI (high 7.5)
- [CVE-2022-25511](https://insights.sbomify.com/CVE-2022-25511/): Path traversal in FreeTAKServer-UI (medium 6.5)
- [CVE-2022-25510](https://insights.sbomify.com/CVE-2022-25510/): Hard coded credentials in FreeTAKServer (high 8.8)
- [CVE-2022-2551](https://insights.sbomify.com/CVE-2022-2551/): Duplicator < 1.4.7 - Unauthenticated Backup Download (high 7.5)
- [CVE-2022-25508](https://insights.sbomify.com/CVE-2022-25508/): Improper Authentication in FreeTAKServer (high 7.5)
- [CVE-2022-25507](https://insights.sbomify.com/CVE-2022-25507/): Cross-site Scripting in FreeTAKServer-UI (medium 5.4)
- [CVE-2022-25506](https://insights.sbomify.com/CVE-2022-25506/): SQL Injection in FreeTAKServer-UI (medium 6.5)
- [CVE-2022-25505](https://insights.sbomify.com/CVE-2022-25505/): SQL injection in taogogo:taocms (critical 9.8)
- [CVE-2022-2550](https://insights.sbomify.com/CVE-2022-2550/): OS Command Injection in hestiacp/hestiacp (critical 9.9)
- [CVE-2022-25498](https://insights.sbomify.com/CVE-2022-25498/): Code injection in cuppacms:cuppacms (critical 9.8)
- [CVE-2022-25497](https://insights.sbomify.com/CVE-2022-25497/): Path traversal in cuppacms:cuppacms (medium 5.3)
- [CVE-2022-25495](https://insights.sbomify.com/CVE-2022-25495/): File upload in cuppacms:cuppacms (critical 9.8)
- [CVE-2022-25494](https://insights.sbomify.com/CVE-2022-25494/): SQL injection in online banking system project:online banking system (critical 9.8)
- [CVE-2022-25493](https://insights.sbomify.com/CVE-2022-25493/): Cross-site scripting in hospital management system project:hospital management system (medium 6.1)
- [CVE-2022-25492](https://insights.sbomify.com/CVE-2022-25492/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-25491](https://insights.sbomify.com/CVE-2022-25491/): SQL injection in hospital management system project:hospital management system (high 7.5)
- [CVE-2022-25490](https://insights.sbomify.com/CVE-2022-25490/): SQL injection in hospital management system project:hospital management system (critical 9.8)
- [CVE-2022-2549](https://insights.sbomify.com/CVE-2022-2549/): NULL Pointer Dereference in gpac/gpac (medium 5.7)
- [CVE-2022-25489](https://insights.sbomify.com/CVE-2022-25489/): Cross-site scripting in thedigitalcraft:atomcms (medium 5.4)
- [CVE-2022-25488](https://insights.sbomify.com/CVE-2022-25488/): SQL injection in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-25487](https://insights.sbomify.com/CVE-2022-25487/): File upload in thedigitalcraft:atomcms (critical 9.8)
- [CVE-2022-25486](https://insights.sbomify.com/CVE-2022-25486/): Path traversal in cuppacms:cuppacms (high 7.8)
- [CVE-2022-25485](https://insights.sbomify.com/CVE-2022-25485/): Path traversal in cuppacms:cuppacms (high 7.8)
- [CVE-2022-25484](https://insights.sbomify.com/CVE-2022-25484/): Denial of service in broadcom:tcpreplay (medium 5.5)
- [CVE-2022-25481](https://insights.sbomify.com/CVE-2022-25481/): Exposure of Resource to Wrong Sphere in ThinkPHP Framework (medium 4.0)
- [CVE-2022-25480](https://insights.sbomify.com/CVE-2022-25480/): Memory corruption in realtek:rtsper (high 7.8)
- [CVE-2022-25479](https://insights.sbomify.com/CVE-2022-25479/): Information disclosure in realtek:rtsper (medium 6.1)
- [CVE-2022-25478](https://insights.sbomify.com/CVE-2022-25478/): Missing authorization in realtek:rtsper (high 7.8)
- [CVE-2022-25477](https://insights.sbomify.com/CVE-2022-25477/): Information disclosure in realtek:rtsper (medium 5.5)
- [CVE-2022-25471](https://insights.sbomify.com/CVE-2022-25471/): Missing authorization in open-emr:openemr (high 8.1)
- [CVE-2022-2547](https://insights.sbomify.com/CVE-2022-2547/): Softing Secure Integration Server NULL Pointer Dereference (high 7.5)
- [CVE-2022-25465](https://insights.sbomify.com/CVE-2022-25465/): Memory corruption in espruino:espruino (high 7.8)
- [CVE-2022-25464](https://insights.sbomify.com/CVE-2022-25464/): Cross-site scripting in html-js:doracms (medium 4.8)
- [CVE-2022-25462](https://insights.sbomify.com/CVE-2022-25462/): Denial of service in yafu project:yafu (high 7.5)
- [CVE-2022-25461](https://insights.sbomify.com/CVE-2022-25461/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25460](https://insights.sbomify.com/CVE-2022-25460/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-2546](https://insights.sbomify.com/CVE-2022-2546/): All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS (medium 4.7)
- [CVE-2022-25459](https://insights.sbomify.com/CVE-2022-25459/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25458](https://insights.sbomify.com/CVE-2022-25458/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25457](https://insights.sbomify.com/CVE-2022-25457/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25456](https://insights.sbomify.com/CVE-2022-25456/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25455](https://insights.sbomify.com/CVE-2022-25455/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25454](https://insights.sbomify.com/CVE-2022-25454/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25453](https://insights.sbomify.com/CVE-2022-25453/): Memory corruption in tenda:ac6 firmware (critical 9.8)
- [CVE-2022-25452](https://insights.sbomify.com/CVE-2022-25452/): Memory corruption in tenda:ac6 firmware (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2022/page/364/