CVE-2022-0837

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerability to drain out the account balance by keep sending SMS notification.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08386.1Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.CVE-2022-08399.8Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.CVE-2022-08404.8The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing hi CVE-2022-08419.8OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.CVE-2022-08424.9A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated at CVE-2022-08438.8Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs CVE-2022-08459.8Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.CVE-2022-08469.8The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL state CVE-2022-08477.8A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe CVE-2022-08489.8OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.CVE-2022-08495.5Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.CVE-2022-08507.1A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.