CVE-2022-25760

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-257617.5The package open62541/open62541 before 1.2.5, from 1.3-rc1 and before 1.3.1 are vulnerable to Denial of Service (DoS) due to a missing limitCVE-2022-257628.6If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5CVE-2022-257637.5Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache CVE-2022-257659.8The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.CVE-2022-257668.8The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /apiCVE-2022-257679.8All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database serCVE-2022-257686.5The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform thCVE-2022-257699.1ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the rooCVE-2022-25778.8A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affects unknown code of CVE-2022-257707.5Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerCVE-2022-257726.1A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executableCVE-2022-257735.4This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. *