CVE-2022-3414

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file /Admin/login.php of the component POST Parameter Handler. The manipulation of the argument txtusername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210246 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-707

Affected software

Vendor	Product	Versions
SourceCodester	Web-Based Student Clearance System	n/a

References

https://vuldb.com/?id.210246Third Party Advisory
https://www.jianshu.com/p/8f7b7b532c02Exploit, Third Party Advisory
https://vuldb.com/?id.210246Third Party Advisory
https://www.jianshu.com/p/8f7b7b532c02Exploit, Third Party Advisory

Timeline

Published: Oct 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-341405.4A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary we CVE-2022-341447.5Transient DOS due to reachable assertion in Modem during OSI decode scheduling.CVE-2022-341457.5Transient DOS due to buffer over-read in WLAN Host while parsing frame information.CVE-2022-341467.5Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.CVE-2022-341477.8Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performa CVE-2022-341484.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migra CVE-2022-341499.8Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.CVE-2022-34156.1The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attacker CVE-2022-341505.4The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter CVE-2022-341518.1Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automat CVE-2022-341526.7Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user CVE-2022-341537.8Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potent