CVE-2022-0495

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Parantez Teknoloji	Parantez Teknoloji	>= unspecified, < 19.05.03

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-22-0635
https://www.usom.gov.tr/bildirim/tr-22-0635Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-22-0635Third Party Advisory

Timeline

Published: Sep 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-04965.5A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-o CVE-2022-04977.1A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annot CVE-2022-04998.8The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate th CVE-2022-05007.8A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF CVE-2022-05016.1Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.CVE-2022-05025.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-05036.1The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting CVE-2022-05046.5Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05056.5Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05065.4Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.CVE-2022-05078.8Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 7 CVE-2022-05085.3Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832