CVE-2022-21643

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addresses, and passwords provided by the user were not sanitized and were used directly to construct a sql statement. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Aaron-Junker	USOC	< Pb2.4Bfx2

References

https://github.com/Aaron-Junker/USOC/commit/21e8bfd7a9ab0b7f9344a7a3a7c32a7cdd5a0b69Patch, Third Party Advisory
https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-fjp4-phjh-jgmcThird Party Advisory
https://github.com/Aaron-Junker/USOC/commit/21e8bfd7a9ab0b7f9344a7a3a7c32a7cdd5a0b69Patch, Third Party Advisory
https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-fjp4-phjh-jgmcThird Party Advisory

Timeline

Published: Jan 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-216447.2USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search term CVE-2022-216468.1SpiceDB is a database system for managing security-critical application permissions. Any user making use of a wildcard relationship under th CVE-2022-216479.8CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgnit CVE-2022-216486.1Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has CVE-2022-216495.4Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> ta CVE-2022-21654.3Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing CVE-2022-216505.4Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload CVE-2022-216516.1Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirect CVE-2022-216528.1Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a CVE-2022-216537.5Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't over CVE-2022-216549.8Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation CVE-2022-216557.5Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal