CVE-2022-35914

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
Sep 19, 2022
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 7, 2023
NVD status
Analyzed

Related CVEs from 2022

CVE-2022-359155.3OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cCVE-2022-359165.3OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossCVE-2022-359175.3Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps aCVE-2022-359186.5Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulCVE-2022-359192.7MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users autCVE-2022-35926.5A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured shCVE-2022-359207.5Sanic is an opensource python web server/framework. Affected versions of sanic allow access to lateral directories when using `app.static` iCVE-2022-359214.3fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement byCVE-2022-359227.5Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an ouCVE-2022-359237.5v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in thCVE-2022-359249.1NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` CVE-2022-359259.8BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentication views which al
CVE-2022-35914: Critical severity, CVSS 9.8 | Vulnix