CVE-2022-23851

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

No affected versions have been published.

Timeline

Published
Dec 17, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-238529.8Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.CVE-2022-238537.8The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP serveCVE-2022-238547.5AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated userCVE-2022-238559.8An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstepCVE-2022-238565.3An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, CVE-2022-238576.5model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An autCVE-2022-238588.8A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system accCVE-2022-23866.1The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, leadCVE-2022-238615.4Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web applCVE-2022-238627.8A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMCVE-2022-238636.5Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.CVE-2022-238659.8Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. To exploit this vulnerability, an atta
CVE-2022-23851: Critical severity, CVSS 9.8 | Vulnix