CVE-2022-4061

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users to upload arbitrary files such as PHP.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Unknown	JobBoardWP	< 1.2.2

References

https://wpscan.com/vulnerability/fec68e6e-f612-43c8-8301-80f7ae3be665Exploit, Third Party Advisory
https://wpscan.com/vulnerability/fec68e6e-f612-43c8-8301-80f7ae3be665Exploit, Third Party Advisory

Timeline

Published: Dec 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-406159.8IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted S CVE-2022-406168.1IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, and 7.6.1.3 could allow a user to bypass authentication and obtain sensitive information or pe CVE-2022-406177.5strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and i CVE-2022-406197.7FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affe CVE-2022-40627.8A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker g CVE-2022-406207.7FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when down CVE-2022-406217.5Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and CVE-2022-406228.8The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use sessio CVE-2022-406238.8The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with o CVE-2022-406249.8pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different CVE-2022-406266.1An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated use CVE-2022-406289.8This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (in