CVE-2022-26251

HighCVSS 7.2/10Last modified Jul 9, 2026

Description

The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2022
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-262526.5aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private CVE-2022-262545.3WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attaCVE-2022-262559.8Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.CVE-2022-262589.8D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.CVE-2022-262597.8A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-CVE-2022-26267.2Incorrect Privilege Assignment in GitHub repository hestiacp/hestiacp prior to 1.6.6.CVE-2022-262609.8Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().CVE-2022-262636.1Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.CVE-2022-262659.8Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.CVE-2022-262668.8Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php.CVE-2022-262677.5Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php.CVE-2022-262689.8Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php.
CVE-2022-26251: High severity, CVSS 7.2 | Vulnix