CVE-2022-47523

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-475245.4F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.CVE-2022-475257.5Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leveragCVE-2022-475269.8Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote aCVE-2022-475296.7Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts CVE-2022-47535.4The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back inCVE-2022-475318.8An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users toCVE-2022-475329.8FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.CVE-2022-47545.4The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputCVE-2022-475428.8Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.CVE-2022-475435.3An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.CVE-2022-475449.8An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.CVE-2022-475475.3GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it
CVE-2022-47523: Critical severity, CVSS 9.8 | Vulnix