CVE-2022-46997

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Viralmaniar/Passhunt/Product, Third Party Advisory
https://github.com/Viralmaniar/Passhunt/issues/14Exploit, Issue Tracking, Third Party Advisory
https://mirrors.neusoft.edu.cn/pypi/web/simple/request/Third Party Advisory
https://github.com/Viralmaniar/Passhunt/Product, Third Party Advisory
https://github.com/Viralmaniar/Passhunt/issues/14Exploit, Issue Tracking, Third Party Advisory
https://mirrors.neusoft.edu.cn/pypi/web/simple/request/Third Party Advisory

Timeline

Published: Dec 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-469989.8An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).CVE-2022-469999.8Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.CVE-2022-47008.8The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX actio CVE-2022-470029.8A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web CVE-2022-470039.8A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request CVE-2022-470075.5An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service d CVE-2022-470085.5An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial CVE-2022-47018.8The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX act CVE-2022-470105.5An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due t CVE-2022-470115.5An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of servi CVE-2022-470127.5Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21.CVE-2022-470156.5MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to