CVE-2022-42745

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	CandidATS	3.0.0

References

https://candidats.net/Product
https://fluidattacks.com/advisories/jcole/Exploit, Third Party Advisory
https://candidats.net/Product
https://fluidattacks.com/advisories/jcole/Exploit, Third Party Advisory

Timeline

Published: Nov 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-427466.1CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This CVE-2022-427476.1CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is CVE-2022-427486.1CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. T CVE-2022-427496.1CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is po CVE-2022-42759.8A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality CVE-2022-427508.8CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does no CVE-2022-427518.8CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffe CVE-2022-427536.1SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not CVE-2022-427545.5In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.CVE-2022-427555.5In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.CVE-2022-427565.5In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of service in kernel.CVE-2022-427573.3In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.