CVE-2022-39033

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Sep 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-390346.5Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A CVE-2022-390356.1Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remoCVE-2022-390369.8The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can CVE-2022-390377.5Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability tCVE-2022-390388.8Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege can change the name ofCVE-2022-390399.8aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to seCVE-2022-39046.1The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthCVE-2022-390407.5aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypCVE-2022-390419.8aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulneraCVE-2022-390429.8aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authenCVE-2022-390432.4Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can accesCVE-2022-390446.8Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege t
CVE-2022-39033: Critical severity, CVSS 9.8 | Vulnix