CVE-2022-25311

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Mar 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-253129.1An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 CVE-2022-253136.5In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.CVE-2022-253147.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.CVE-2022-253159.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.CVE-2022-253176.1An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.CVE-2022-253184.3An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit and modify sharing gro CVE-2022-253195.3An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.CVE-2022-25326.1The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading t CVE-2022-253205.3An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.CVE-2022-253216.1An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.CVE-2022-253229.8ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.CVE-2022-253236.1ZEROF Web Server 2.0 allows /admin.back XSS.