CVE-2022-38116

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Le-yan Co., Ltd.	Personnel and Salary Management System	>= unspecified, <= 2022/6/6

References

https://www.twcert.org.tw/tw/cp-132-6460-2bb02-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-6460-2bb02-1.htmlThird Party Advisory

Timeline

Published: Aug 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-381176.1Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to CVE-2022-381188.8OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform CVE-2022-381199.8UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authe CVE-2022-38126.5A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::A CVE-2022-381206.5UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass auth CVE-2022-381216.5UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege c CVE-2022-381227.5UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to ac CVE-2022-381237.2Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code int CVE-2022-381246.5Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.CVE-2022-381255.5Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiti CVE-2022-381299.8A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor M CVE-2022-38136.5A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The man