CVE-2022-40200

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 17, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-402017.8Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed desigCVE-2022-402029.8The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attaCVE-2022-402038.8Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WoCVE-2022-402045.4A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in unCVE-2022-402054.3Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or CVE-2022-402064.3Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or CVE-2022-402077.8Improper access control in the Intel(R) SUR software before version 2.4.8989 may allow an authenticated user to potentially enable escalatioCVE-2022-402084.3In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz atCVE-2022-402096.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress.CVE-2022-40214.3The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. ThisCVE-2022-402107.8Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enabCVE-2022-402114.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue af
CVE-2022-40200: High severity, CVSS 8.8 | Vulnix