CVE-2022-27174

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
COREMOBILE Co. Ltd.	Easy Blog for EC-CUBE4	Ver.1.0.1 and earlier

References

https://jvn.jp/en/jp/JVN46241173/index.htmlThird Party Advisory, VDB Entry
https://www.ec-cube.net/products/detail.php?product_id=2217Product, Vendor Advisory
https://jvn.jp/en/jp/JVN46241173/index.htmlThird Party Advisory, VDB Entry
https://www.ec-cube.net/products/detail.php?product_id=2217Product, Vendor Advisory

Timeline

Published: Jun 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-271759.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This CVE-2022-271767.8Incomplete filtering of special elements vulnerability exists in RevoWorks SCVX using 'File Sanitization Library' 1.043 and prior versions, CVE-2022-271779.8A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to CVE-2022-271789.8A denial of service vulnerability exists in the confctl_set_wan_cfg functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-cr CVE-2022-271796.5A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain access to the protecte CVE-2022-27184.9The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' par CVE-2022-271807.8Uncontrolled search path in the Intel(R) MacCPUID software before version 3.2 may allow an authenticated user to potentially enable escalati CVE-2022-271815.3On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions pr CVE-2022-271825.3On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet CVE-2022-271836.1The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions befo CVE-2022-271847.8The affected product is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.CVE-2022-271857.5A denial of service vulnerability exists in the confctl_set_master_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially