CVE-2022-45185

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Jan 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-451868.1An issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of a database.CVE-2022-451887.8Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. This provides re CVE-2022-45194.8The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, CVE-2022-451905.3An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can bypass passkey entry in the legacy pairing CVE-2022-451916.5An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a pair CVE-2022-451926.5An issue was discovered on Microchip RN4870 1.43 devices. An attacker within BLE radio range can cause a denial of service by sending a clea CVE-2022-451938.8CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation.CVE-2022-451944.7CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure.CVE-2022-451955.3SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere w CVE-2022-451967.5Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the sam CVE-2022-451977.5Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixm CVE-2022-451987.5Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).