CVE-2022-43074

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/loadream/AyaCMS/issues/3Exploit, Issue Tracking, Third Party Advisory
https://github.com/loadream/AyaCMS/issues/3Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Nov 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-430764.8A cross-site scripting (XSS) vulnerability in /admin/edit-admin.php of Web-Based Student Clearance System v1.0 allows attackers to execute a CVE-2022-430784.8A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Web-Based Student Clearance System v1.0 allows attackers to execute arbi CVE-2022-430796.1A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scrip CVE-2022-43088.8Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generat CVE-2022-430817.5Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.CVE-2022-430826.1A cross-site scripting (XSS) vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary CVE-2022-430837.2An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary code vi CVE-2022-430844.8A cross-site scripting (XSS) vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary web CVE-2022-430857.2An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a cra CVE-2022-430864.9Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via update_customer.php.CVE-2022-43093.1The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in a CVE-2022-430966.8Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.