CVE-2022-2212

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component /card/index.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
SourceCodester	Library Management System	1.0

References

https://github.com/CyberThoth/CVE/blob/main/CVE/Library%20Management%20System%20with%20QR%20code%20Attendance/File_Upload/POC.mdExploit, Third Party Advisory
https://vuldb.com/?id.202758Third Party Advisory, VDB Entry
https://github.com/CyberThoth/CVE/blob/main/CVE/Library%20Management%20System%20with%20QR%20code%20Attendance/File_Upload/POC.mdExploit, Third Party Advisory
https://vuldb.com/?id.202758Third Party Advisory, VDB Entry

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-221205.3In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset f CVE-2022-221218.0In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can cre CVE-2022-221235.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated atta CVE-2022-221245.4In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated atta CVE-2022-221254.8In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin CVE-2022-221266.1Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection of malicious JavaScr CVE-2022-221277.2Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity CVE-2022-221289.8Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agent’s internal file transfer service that could CVE-2022-22135.4A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerabili CVE-2022-221376.5A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malform CVE-2022-221387.5All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. CVE-2022-221397.3Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalati