CVE-2022-0959

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-09605.4Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09615.5The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of CVE-2022-09625.4Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09635.4Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.CVE-2022-09645.4Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09655.4Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09665.4Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.CVE-2022-09675.4Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09685.5The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Deni CVE-2022-09694.8The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images fo CVE-2022-09705.4Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.CVE-2022-09718.8Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer