CVE-2022-28606

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An arbitrary file upload vulnerability exists in Wenzhou Huoyin Information Technology Co., Ltd. BossCMS 1.0, which can be exploited by an attacker to gain control of the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.bosscms.net/Broken Link
https://www.cnvd.org.cn/flaw/show/CNVD-2022-04804Third Party Advisory
https://www.cnvd.org.cn/patchInfo/show/313666Third Party Advisory
https://www.bosscms.net/Broken Link
https://www.cnvd.org.cn/flaw/show/CNVD-2022-04804Third Party Advisory
https://www.cnvd.org.cn/patchInfo/show/313666Third Party Advisory

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-286077.5An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive inf CVE-2022-28616.5Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install CVE-2022-286117.2Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to po CVE-2022-286125.4Improper Access Control vulnerability leading to multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) CVE-2022-286137.5A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is en-abled and c CVE-2022-286145.3The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect CVE-2022-286159.1Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with CVE-2022-286169.8A remote server-side request forgery (ssrf) vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a softwar CVE-2022-286179.8A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has provided a software upda CVE-2022-286189.8A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Array CVE-2022-286197.8A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The vulnerability could a CVE-2022-28627.8Use After Free in GitHub repository vim/vim prior to 9.0.0221.