CVE-2022-38488

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-384895.4An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1CVE-2022-38498.8The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadiCVE-2022-384908.8An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 correctsCVE-2022-384917.5An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-fCVE-2022-384928.8An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes theCVE-2022-384937.5Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cauCVE-2022-384957.8LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.CVE-2022-384965.5LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.CVE-2022-384975.5LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.CVE-2022-38504.3The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a lCVE-2022-385099.8Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php.CVE-2022-385107.8Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.
CVE-2022-38488: Critical severity, CVSS 9.8 | Vulnix