CVE-2022-39066

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attacker could use the vulnerability to execute arbitrary SQL injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-390676.5There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticateCVE-2022-390686.5There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attackeCVE-2022-390695.3There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attackCVE-2022-39077.5The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage oCVE-2022-390709.8There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use tCVE-2022-390717.1There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overCVE-2022-390725.4There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SCVE-2022-390739.8There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the CVE-2022-390743.3There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could starCVE-2022-390757.1There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could deleCVE-2022-39086.1The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a ReCVE-2022-390807.8In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional