CVE-2022-42458

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
Shift Tech Inc.bingo!CMSversion1.7.4.1 and earlier

References

Timeline

Published
Dec 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-424597.2Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress.CVE-2022-42467.5A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler.CVE-2022-424605.4Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress.CVE-2022-424618.8Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-424624.8Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.CVE-2022-424638.8OpenHarmony-v3.1.2 and prior versions have an authenication bypass vulnerability in a callback handler function of Softbus_server in communiCVE-2022-424647.8OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device CVE-2022-424656.7Improper access control in kernel mode driver for the Intel(R) OFU software before version 14.1.30 may allow a privileged user to potentiallCVE-2022-424666.1Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would CVE-2022-424675.3When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the abiliCVE-2022-424689.8Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source witCVE-2022-424694.3A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW