CVE-2022-2418

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
URVE	Web Manager	n/a

References

https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.mdExploit, Third Party Advisory
https://vuldb.com/?id.203901Third Party Advisory, VDB Entry
https://github.com/joinia/webray.com.cn/blob/main/URVE/URVE%20Web%20Manager%20img_upload.php%20File%20upload%20vulnerability.mdExploit, Third Party Advisory
https://vuldb.com/?id.203901Third Party Advisory, VDB Entry

Timeline

Published: Jul 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-241816.1Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary cod CVE-2022-241877.5The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabi CVE-2022-241887.5The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the pictu CVE-2022-241896.5The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value ca CVE-2022-24198.0A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _intern CVE-2022-241907.5The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is n CVE-2022-241915.5In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in CVE-2022-241939.8CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.CVE-2022-241966.5iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, wh CVE-2022-241976.5iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a CVE-2022-241986.5iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attacker CVE-2022-24208.0A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _intern