CVE-2022-26676

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Apr 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-26687.2An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS CVE-2022-266884.4An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOSCVE-2022-26696.1The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leadinCVE-2022-266904.7Description: A race condition was addressed with additional validation. This issue is fixed in macOS Monterey 12.3. A malicious application CVE-2022-266916.7A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, mCVE-2022-266939.1This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. A plug-in may be able to inherit the application'CVE-2022-266949.1This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. A plug-in may be able to inherit the application'CVE-2022-266968.8This issue was addressed with improved environment sanitization. This issue is fixed in macOS Monterey 12.4. A sandboxed process may be ableCVE-2022-266977.1An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS MoCVE-2022-266987.1An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS MonCVE-2022-266995.5A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to cause a denial-ofCVE-2022-267008.8A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 1
CVE-2022-26676: Critical severity, CVSS 9.8 | Vulnix