CVE-2022-46609

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/herry-zhang/Python3-RESTfulAPI/Product, Third Party Advisory
https://github.com/herry-zhang/Python3-RESTfulAPI/blob/1c2081dca357685b3180b9baeb7e761e9a10ca99/SECURITY.mdExploit, Third Party Advisory
https://github.com/herry-zhang/Python3-RESTfulAPI/commit/1c2081dca357685b3180b9baeb7e761e9a10ca99Third Party Advisory
https://mirrors.neusoft.edu.cn/pypi/web/simple/request/Product, Third Party Advisory
https://github.com/herry-zhang/Python3-RESTfulAPI/Product, Third Party Advisory
https://github.com/herry-zhang/Python3-RESTfulAPI/blob/1c2081dca357685b3180b9baeb7e761e9a10ca99/SECURITY.mdExploit, Third Party Advisory
https://github.com/herry-zhang/Python3-RESTfulAPI/commit/1c2081dca357685b3180b9baeb7e761e9a10ca99Third Party Advisory
https://mirrors.neusoft.edu.cn/pypi/web/simple/request/Product, Third Party Advisory

Timeline

Published: Dec 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46615.4The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attribute CVE-2022-466108.872crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attacker CVE-2022-46625.5A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use CVE-2022-466226.1A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a CVE-2022-466237.8Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-466246.1A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML CVE-2022-46636.1The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in v CVE-2022-466319.8TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett CVE-2022-466349.8TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the sett CVE-2022-466379.8Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.CVE-2022-466397.5A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.CVE-2022-46645.4The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a