CVE-2022-34919

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file, it is possible to execute arbitrary commands.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-34928.8A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown CVE-2022-349247.5Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the componCVE-2022-349277.8MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the CVE-2022-349288.8JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.CVE-2022-34935.4A vulnerability, which was classified as problematic, has been found in SourceCodester Human Resource Management System 1.0. This issue affeCVE-2022-349378.8Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vulnerability allows atCVE-2022-34948.8The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQLCVE-2022-349459.8Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getproductreport.php.CVE-2022-349469.8Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getexpproduct.php.CVE-2022-349479.8Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcategory.php.CVE-2022-349489.8Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbrand.php.CVE-2022-349499.8Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at logi
CVE-2022-34919: Critical severity, CVSS 9.8 | Vulnix