CVE-2022-3774

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-99

Affected software

Vendor	Product	Versions
SourceCodester	Train Scheduler App	1.0

References

http://packetstormsecurity.com/files/169604/Train-Scheduler-App-1.0-Insecure-Direct-Object-Reference.htmlExploit, Third Party Advisory
https://github.com/rohit0x5/poc/blob/main/idorBroken Link, Third Party Advisory
https://vuldb.com/?id.212504Third Party Advisory
http://packetstormsecurity.com/files/169604/Train-Scheduler-App-1.0-Insecure-Direct-Object-Reference.htmlExploit, Third Party Advisory
https://github.com/rohit0x5/poc/blob/main/idorBroken Link, Third Party Advisory
https://vuldb.com/?id.212504Third Party Advisory

Timeline

Published: Oct 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-37757.1When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained CVE-2022-37768.8The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions CVE-2022-377679.8Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the ve CVE-2022-377687.5libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.CVE-2022-377696.5libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecoder.hpp. This vulnerability allo CVE-2022-377706.5libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at linemerger.cpp. This vulnerabili CVE-2022-377716.7IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to CVE-2022-377727.5Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the a CVE-2022-377736.5An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allow CVE-2022-377745.3There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an a CVE-2022-377756.1Genesys PureConnect Interaction Web Tools Chat Service (up to at least 26- September- 2019) allows XSS within the Printable Chat History via CVE-2022-377777.2Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution (R