CVE-2022-39303

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Ree6 is a moderation bot. This vulnerability allows manipulation of SQL queries. This issue has been patched in version 1.7.0 by using Javas PreparedStatements, which allow object setting without the risk of SQL injection. There are currently no known workarounds.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Ree6-Applications	Ree6	<= 1.6.4

References

https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7.Release Notes, Third Party Advisory
https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-69xv-xjfw-4pv8Patch, Third Party Advisory
https://github.com/Ree6-Applications/Ree6/compare/1.6.4...1.7.Release Notes, Third Party Advisory
https://github.com/Ree6-Applications/Ree6/security/advisories/GHSA-69xv-xjfw-4pv8Patch, Third Party Advisory

Timeline

Published: Oct 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-393044.7ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghins CVE-2022-393059.8Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Versions prior to CVE-2022-393068.1Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Im CVE-2022-393075.3Grafana is an open-source platform for monitoring and observability. When using the forget password on the login page, a POST request is mad CVE-2022-393085.9GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your pr CVE-2022-393096.5GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your pr CVE-2022-393106.5GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your pr CVE-2022-393118.8GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your pr CVE-2022-393129.8Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the CVE-2022-393137.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior CVE-2022-393143.7Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Re CVE-2022-393155.3Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all K