First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-2550

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
hestiacp	hestiacp/hestiacp	>= unspecified, < 1.6.5

References

https://github.com/hestiacp/hestiacp/commit/3d4c309cf138943cfd1e71ae51556406987aa4bfPatch, Third Party Advisory
https://huntr.dev/bounties/6ab4384d-bcbe-4d98-bf67-35c3535fc5c7Exploit, Third Party Advisory
https://github.com/hestiacp/hestiacp/commit/3d4c309cf138943cfd1e71ae51556406987aa4bfPatch, Third Party Advisory
https://huntr.dev/bounties/6ab4384d-bcbe-4d98-bf67-35c3535fc5c7Exploit, Third Party Advisory

Timeline

Published: Jul 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-255059.8Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php.CVE-2022-255066.5FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.CVE-2022-255075.4FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.CVE-2022-255087.5An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial o CVE-2022-25517.5The Duplicator WordPress plugin before 1.4.7 discloses the url of the a backup to unauthenticated visitors accessing the main installer endp CVE-2022-255108.8FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escal CVE-2022-255116.5An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anyw CVE-2022-255127.5FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.CVE-2022-255147.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttUSHORT() at stb_truetype.h. NOTE: Third party has d CVE-2022-255156.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function ttULONG() at stb_truetype.h. NOTE: Third party has di CVE-2022-255166.5stb_truetype.h v1.26 was discovered to contain a heap-buffer-overflow via the function stbtt__find_table at stb_truetype.h. NOTE: Third part CVE-2022-255179.8MyBatis plus v3.4.3 was discovered to contain a SQL injection vulnerability via the Column parameter in /core/conditions/AbstractWrapper.jav