CVE-2022-23889

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-674

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-23894.3The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin beforeCVE-2022-238965.4Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).CVE-2022-238989.8MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.CVE-2022-238999.8MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.CVE-2022-23908.4Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification CVE-2022-239009.8A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unaCVE-2022-239019.8A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.CVE-2022-239029.8Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.CVE-2022-239035.4A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary fuCVE-2022-239048.0Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his acCVE-2022-239067.2CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerCVE-2022-239076.1CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.