CVE-2022-23986

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecified vectors.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Dojin Club MICMNIS	phpUploader	v1.2 and earlier

References

https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1Patch, Release Notes, Third Party Advisory
https://jvn.jp/en/jp/JVN00095004/index.htmlThird Party Advisory
https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1Patch, Release Notes, Third Party Advisory
https://jvn.jp/en/jp/JVN00095004/index.htmlThird Party Advisory

Timeline

Published: Feb 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-239874.8The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users CVE-2022-239886.1The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker CVE-2022-239897.5In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood CVE-2022-23998.8Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2022-239907.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.CVE-2022-239929.8XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could poten CVE-2022-239936.1/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS CVE-2022-239943.3An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted CVE-2022-239953.3Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted CVE-2022-239963.3Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted appli CVE-2022-239973.3Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows un CVE-2022-239985.5Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in A