CVE-2022-39179

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious code via student.php file.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-39188.8A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In CVE-2022-391809.8College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php pageCVE-2022-391816.1GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data direCVE-2022-391828.8H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actorCVE-2022-391836.1Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors.CVE-2022-391849.8EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass.CVE-2022-391859.8EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user.CVE-2022-391865.5EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissionsCVE-2022-391876.1Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors.CVE-2022-391884.7An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versuCVE-2022-391897.8An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromise the guest kernel bCVE-2022-39194.8The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perf
CVE-2022-39179: High severity, CVSS 7.2 | Vulnix