CVE-2022-23320

HighCVSS 7.5/10Last modified Jul 9, 2026

Description

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29Third Party Advisory
https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/Exploit, Third Party Advisory
https://www.xmpie.com/ustore-release-notes/Release Notes, Vendor Advisory
https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29Third Party Advisory
https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/Exploit, Third Party Advisory
https://www.xmpie.com/ustore-release-notes/Release Notes, Vendor Advisory

Timeline

Published: Feb 7, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-233214.8A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the X CVE-2022-233277.5A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in on CVE-2022-233287.5A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account CVE-2022-233299.8A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via CVE-2022-23337.8If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell S CVE-2022-233308.8A remote code execution (RCE) vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code vi CVE-2022-233318.8In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the administrator password.CVE-2022-233328.8Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-CVE-2022-233349.8The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers CVE-2022-233359.8Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParameter.CVE-2022-233369.8S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.CVE-2022-233379.8DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parameter.