CVE-2022-23810

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to obtain an arbitrary file on the server via unspecified vectors.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
appleple inc.	a-blog cms	Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1

References

https://developer.a-blogcms.jp/blog/news/security-202202.htmlVendor Advisory
https://jvn.jp/en/jp/JVN14706307/index.htmlThird Party Advisory
https://developer.a-blogcms.jp/blog/news/security-202202.htmlVendor Advisory
https://jvn.jp/en/jp/JVN14706307/index.htmlThird Party Advisory

Timeline

Published: Feb 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238129.8This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in CVE-2022-238135.3The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest me CVE-2022-238145.3Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confide CVE-2022-238158.2Improper bounds checking in APCB firmware may allow an attacker to perform an out of bounds write, corrupting the APCB entry, potentially le CVE-2022-238177.3Insufficient checking of memory buffer in AMD Secure Processor (ASP) Secure OS may allow an attacker with a malicious trusted application to CVE-2022-238187.5Insufficient input validation on the model specific register: VM_HSAVE_PA may potentially lead to loss of SEV-SNP guest memory integrity.CVE-2022-23824.3The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, CVE-2022-238209.8Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execut CVE-2022-238219.8Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code exec CVE-2022-238226.8In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication an CVE-2022-238236.5A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to p CVE-2022-238245.5IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure