CVE-2022-25045

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Mar 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-250469.8A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.CVE-2022-250475.9The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.CVE-2022-250488.8Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.CVE-2022-25058.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of me CVE-2022-250505.5rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a CVE-2022-250515.5An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.CVE-2022-250609.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.CVE-2022-250619.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.CVE-2022-250627.5TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows CVE-2022-250649.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr CVE-2022-250699.6Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote co CVE-2022-25075.3In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage