CVE-2022-2419

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-241907.5The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is n CVE-2022-241915.5In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in CVE-2022-241939.8CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.CVE-2022-241966.5iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, wh CVE-2022-241976.5iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a CVE-2022-241986.5iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attacker CVE-2022-24208.0A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _intern CVE-2022-242069.8Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.CVE-2022-24219.8Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which al CVE-2022-242189.1An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files.CVE-2022-242199.8eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php.CVE-2022-24229.8Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in c