CVE-2022-44289

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-44294.4Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial oCVE-2022-442909.8webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.CVE-2022-442919.8webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.CVE-2022-442947.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=.CVE-2022-442957.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.CVE-2022-442967.2Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=.CVE-2022-442979.8SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.CVE-2022-442989.8SiteServer CMS 7.1.3 is vulnerable to SQL Injection.CVE-2022-442994.9SiteServerCMS 7.1.3 sscms has a file read vulnerability.CVE-2022-443036.1Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedulCVE-2022-44315.4The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the pCVE-2022-443107.5In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shar
CVE-2022-44289: High severity, CVSS 8.8 | Vulnix