CVE-2022-3549

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-354909.8Zammad 5.2.0 is vulnerable to privilege escalation. Zammad has a prevention against brute-force attacks trying to guess login credentials. A CVE-2022-354919.8TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample.CVE-2022-354936.1A Cross-site scripting (XSS) vulnerability in json search parse and the json response in wrteam.in, eShop - Multipurpose Ecommerce Store Web CVE-2022-354975.4In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via re CVE-2022-354997.1In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary p CVE-2022-35508.8A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the fi CVE-2022-355005.4Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality.CVE-2022-355015.4Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post functio CVE-2022-355037.5Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM m CVE-2022-355057.5A segmentation fault in TripleCross v0.1.0 occurs when sending a control command from the client to the server. This occurs because there is CVE-2022-355067.5TripleCross v0.1.0 was discovered to contain a stack overflow which occurs because there is no limit to the length of program parameters.CVE-2022-355077.1A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows