CVE-2022-25923

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jan 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-259267.8Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanCVE-2022-259277.5Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression DenialCVE-2022-259295.4The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in sCVE-2022-25937.2The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL querCVE-2022-259317.5All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being emploCVE-2022-259329.8The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An aCVE-2022-259367.5Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.CVE-2022-259376.5Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root diCVE-2022-25948.8The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated CVE-2022-259407.5All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control chCVE-2022-259427.8An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead tCVE-2022-259437.8The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the serv