CVE-2022-23358

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

EasyCMS v1.6 allows for SQL injection via ArticlemAction.class.php. In the background, search terms provided by the user were not sanitized and were used directly to construct a SQL statement.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-23369.8Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` anCVE-2022-233639.8Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php.CVE-2022-233649.8HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php.CVE-2022-233659.8HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php.CVE-2022-233669.8HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.CVE-2022-233676.1Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerabiliCVE-2022-23377.5A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22.CVE-2022-233758.8WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upCVE-2022-233766.1WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.CVE-2022-233777.5Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local files.CVE-2022-233785.4A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a requCVE-2022-233799.8Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().