Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2022

104 records · 18 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2021-24762
    65This week

    Perfect Survey < 1.5.2 - Unauthenticated SQL Injection

    CriticalCVSS 9.8WeaponizedEPSS 86%

    getperfectsurvey · perfect surveyFeb 1, 2022

  • CVE-2021-24926
    28Monitor

    Domain Check < 1.0.17 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 12%

    domaincheckplugin · domain checkFeb 1, 2022

  • CVE-2022-24218
    41Plan

    An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files.

    CriticalCVSS 9.1No exploitEPSS 16%

    elitecms · elite cmsFeb 1, 2022

  • CVE-2022-24223
    58Plan

    AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.

    CriticalCVSS 9.8Proof of conceptEPSS 61%

    thedigitalcraft · atomcmsFeb 1, 2022

  • CVE-2021-43062
    28Monitor

    A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, versio

    MediumCVSS 6.1Proof of conceptEPSS 12%

    fortinet · fortimailFeb 2, 2022

  • CVE-2022-23833
    45Plan

    An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.

    HighCVSS 7.5No exploitEPSS 49%

    djangoproject · djangoFeb 2, 2022

  • CVE-2022-23357
    42Plan

    mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir.

    CriticalCVSS 9.1No exploitEPSS 19%

    mozilo · mozilocmsFeb 2, 2022

  • CVE-2022-24144
    45Plan

    Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting.

    CriticalCVSS 9.8No exploitEPSS 18%

    tenda · ax3 firmwareFeb 3, 2022

  • CVE-2022-24260
    54Plan

    A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    voipmonitor · voipmonitorFeb 4, 2022

  • CVE-2022-23329
    43Plan

    A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via

    CriticalCVSS 9.8No exploitEPSS 14%

    ujcms · jspxcmsFeb 4, 2022

  • CVE-2022-0218
    44Plan

    WP HTML Mail <= 3.0.9 Missing Authorization on REST-API Route

    MediumCVSS 6.1Proof of conceptEPSS 66%

    codemiq · wordpress email template designerFeb 4, 2022

  • CVE-2022-0437
    29Monitor

    Cross-site Scripting (XSS) - DOM in karma-runner/karma

    MediumCVSS 6.1Proof of conceptEPSS 15%

    karma project · karmaFeb 4, 2022

  • CVE-2022-22831
    42Plan

    An issue was discovered in Servisnet Tessa 0.0.2.

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    servisnet · tessaFeb 6, 2022

  • CVE-2022-22832
    43Plan

    An issue was discovered in Servisnet Tessa 0.0.2.

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    servisnet · tessaFeb 6, 2022

  • CVE-2022-22833
    33Monitor

    An issue was discovered in Servisnet Tessa 0.0.2.

    HighCVSS 7.5Proof of conceptEPSS 11%

    servisnet · tessaFeb 6, 2022

  • CVE-2021-25114
    64This week

    Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 81%

    strangerstudios · paid memberships proFeb 7, 2022

  • CVE-2021-44864
    29Monitor

    TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow.

    MediumCVSS 6.5No exploitEPSS 10%

    tp-link · wn886n firmwareFeb 8, 2022

  • CVE-2022-24682
    63This week

    An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the w

    MediumCVSS 6.1KEVWeaponizedEPSS 30%

    synacor · zimbra collaboration suiteFeb 9, 2022

  • CVE-2021-46354
    34Monitor

    Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the par

    HighCVSS 7.5Proof of conceptEPSS 12%

    cybelesoft · thinfinity virtualuiFeb 9, 2022

  • CVE-2022-21971
    77This week

    Windows Runtime Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 53%

    microsoft · windows 10 1809Feb 9, 2022

  • CVE-2022-21993
    43Plan

    Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability

    HighCVSS 7.5No exploitEPSS 43%

    microsoft · windows 10Feb 9, 2022

  • CVE-2022-21999
    73This week

    Windows Print Spooler Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 41%

    microsoft · windows 10 1507Feb 9, 2022

  • CVE-2022-22005
    40Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 16%

    microsoft · sharepoint enterprise serverFeb 9, 2022

  • CVE-2022-22715
    35Monitor

    Named Pipe File System Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 13%

    microsoft · windows 10Feb 9, 2022

  • CVE-2022-22718
    67This week

    Windows Print Spooler Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 18%

    microsoft · windows 10 1507Feb 9, 2022

  • CVE-2022-22536
    99Now

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher

    CriticalCVSS 10.0KEVWeaponizedEPSS 97%

    sap · content serverFeb 9, 2022

  • CVE-2022-24313
    52Plan

    A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leadin

    CriticalCVSS 9.8No exploitEPSS 44%

    schneider-electric · interactive graphical scada system data serverFeb 9, 2022

  • CVE-2022-24314
    35Monitor

    A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker

    HighCVSS 7.5No exploitEPSS 18%

    schneider-electric · interactive graphical scada system data serverFeb 9, 2022

  • CVE-2022-24315
    36Monitor

    A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted

    HighCVSS 7.5No exploitEPSS 19%

    schneider-electric · interactive graphical scada system data serverFeb 9, 2022

  • CVE-2021-45901
    25Monitor

    The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the usern

    MediumCVSS 5.3Proof of conceptEPSS 14%

    servicenow · servicenowFeb 10, 2022

  • CVE-2022-20699
    91Now

    Cisco Small Business RV Series Routers Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 72%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-20700
    71This week

    Cisco Small Business RV Series Routers Vulnerabilities

    CriticalCVSS 9.8KEVWeaponizedEPSS 5%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-20701
    64This week

    Cisco Small Business RV Series Routers Vulnerabilities

    HighCVSS 7.8KEVWeaponizedEPSS 9%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-20703
    65This week

    Cisco Small Business RV Series Routers Vulnerabilities

    HighCVSS 8.0KEVWeaponizedEPSS 9%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-20705
    63This week

    Cisco Small Business RV Series Routers Vulnerabilities

    CriticalCVSS 9.8WeaponizedEPSS 80%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-20707
    60This week

    Cisco Small Business RV Series Routers Vulnerabilities

    HighCVSS 7.3WeaponizedEPSS 75%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-20708
    66This week

    Cisco Small Business RV Series Routers Vulnerabilities

    HighCVSS 8.0KEVWeaponizedEPSS 14%

    cisco · rv340 firmwareFeb 10, 2022

  • CVE-2022-24954
    43Plan

    Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpa

    CriticalCVSS 9.8No exploitEPSS 11%

    foxit · pdf readerFeb 10, 2022

  • CVE-2022-0557
    43Plan

    OS Command Injection in microweber/microweber

    HighCVSS 7.2Proof of conceptEPSS 51%

    microweber · microweberFeb 11, 2022

  • CVE-2021-44521
    53Plan

    Remote code execution for scripted UDFs

    CriticalCVSS 9.1Proof of conceptEPSS 57%

    apache · cassandraFeb 11, 2022

  • CVE-2022-24112
    98Now

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    apache · apisixFeb 11, 2022

  • CVE-2021-22802
    45Plan

    A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length

    CriticalCVSS 9.8No exploitEPSS 20%

    schneider-electric · interactive graphical scada system data collectorFeb 11, 2022

  • CVE-2021-22823
    42Plan

    A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of

    CriticalCVSS 9.1No exploitEPSS 21%

    schneider-electric · interactive graphical scada system data collectorFeb 11, 2022

  • CVE-2021-22824
    34Monitor

    A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length che

    HighCVSS 7.5No exploitEPSS 14%

    schneider-electric · interactive graphical scada system data collectorFeb 11, 2022

  • CVE-2021-31932
    45Plan

    Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass.

    CriticalCVSS 9.8No exploitEPSS 21%

    nokia · bts trs web consoleFeb 11, 2022

  • CVE-2022-0185
    71This week

    A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux

    HighCVSS 8.4KEVWeaponizedEPSS 25%

    linux · linux kernelFeb 11, 2022

  • CVE-2021-4102
    67This week

    Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 7%

    google · chromeFeb 11, 2022

  • CVE-2022-0289
    43Plan

    Use after free in Safe browsing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via

    HighCVSS 8.8No exploitEPSS 27%

    google · chromeFeb 11, 2022

  • CVE-2022-0306
    61This week

    Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a

    HighCVSS 8.8No exploitEPSS 85%

    google · chromeFeb 11, 2022

  • CVE-2022-0572
    39Monitor

    Heap-based Buffer Overflow in vim/vim

    HighCVSS 7.8No exploitEPSS 26%

    vim · vimFeb 14, 2022

  • CVE-2021-45420
    44Plan

    Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    emerson · dixell xweb-500 firmwareFeb 14, 2022

  • CVE-2021-45392
    34Monitor

    A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the

    HighCVSS 7.5No exploitEPSS 12%

    tenda · ax12 firmwareFeb 14, 2022

  • CVE-2022-23389
    46Plan

    PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.

    CriticalCVSS 9.8No exploitEPSS 21%

    publiccms · publiccmsFeb 14, 2022

  • CVE-2021-43734
    33Monitor

    kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.

    HighCVSS 7.5Proof of conceptEPSS 10%

    keking · kkfileviewFeb 15, 2022

  • CVE-2021-35380
    41Plan

    A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious u

    HighCVSS 7.5Proof of conceptEPSS 36%

    solari · termtalk serverFeb 15, 2022

  • CVE-2022-25236
    50Plan

    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    libexpat project · libexpatFeb 16, 2022

  • CVE-2022-0513
    46Plan

    WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason

    HighCVSS 7.5No exploitEPSS 53%

    veronalabs · wp statisticsFeb 16, 2022

  • CVE-2022-24086
    99Now

    Adobe Commerce checkout improper input validation leads to remote code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · commerceFeb 16, 2022

  • CVE-2021-3560
    68This week

    It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor

    HighCVSS 7.8KEVWeaponizedEPSS 23%

    polkit project · polkitFeb 16, 2022

  • CVE-2021-3781
    64This week

    A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted

    CriticalCVSS 9.9No exploitEPSS 83%

    artifex · ghostscriptFeb 16, 2022

  • CVE-2021-45382
    98Now

    A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    dlink · dir-820l firmwareFeb 17, 2022

  • CVE-2021-46314
    49Plan

    A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW

    CriticalCVSS 9.8No exploitEPSS 33%

    dlink · dir-846 firmwareFeb 17, 2022

  • CVE-2022-22916
    51Plan

    O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    zoneland · o2oaFeb 17, 2022

  • CVE-2022-0666
    43Plan

    CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

    HighCVSS 7.5Proof of conceptEPSS 44%

    microweber · microweberFeb 18, 2022

  • CVE-2022-0543
    100Now

    It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    redis · redisFeb 18, 2022

  • CVE-2022-23642
    57Plan

    Code Injection in Sourcegraph

    HighCVSS 8.8WeaponizedEPSS 74%

    sourcegraph · sourcegraphFeb 18, 2022

  • CVE-2022-23375
    41Plan

    WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability.

    HighCVSS 8.8No exploitEPSS 19%

    wikidocs · wikidocsFeb 19, 2022

  • CVE-2021-24867
    44Plan

    Backdoored Plugins & Themes from AccessPress Themes

    CriticalCVSS 9.8No exploitEPSS 18%

    accesspressthemes · accessbuddyFeb 21, 2022

  • CVE-2021-44142
    57Plan

    The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and intero

    HighCVSS 8.8Proof of conceptEPSS 73%

    samba · sambaFeb 21, 2022

  • CVE-2022-0564
    21Monitor

    Qlik Sense Enterprise Domain User enumeration

    MediumCVSS 5.3No exploitEPSS 1%

    qlik · qlik senseFeb 21, 2022

  • CVE-2022-24295
    40Plan

    Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially craft

    HighCVSS 8.8No exploitEPSS 16%

    okta · advanced server access client for windowsFeb 21, 2022

  • CVE-2022-0714
    26Monitor

    Heap-based Buffer Overflow in vim/vim

    MediumCVSS 5.5No exploitEPSS 12%

    vim · vimFeb 22, 2022

  • CVE-2022-20623
    34Monitor

    Cisco Nexus 9000 Series Switches Bidirectional Forwarding Detection Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 11%

    cisco · nx-osFeb 23, 2022

  • CVE-2022-20624
    34Monitor

    Cisco NX-OS Software Cisco Fabric Services Over IP Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 12%

    cisco · nx-osFeb 23, 2022

  • CVE-2022-20650
    39Monitor

    Cisco NX-OS Software NX-API Command Injection Vulnerability

    HighCVSS 8.8No exploitEPSS 14%

    cisco · nx-osFeb 23, 2022

  • CVE-2022-25329
    40Plan

    Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in

    CriticalCVSS 9.8No exploitEPSS 2%

    trendmicro · serverprotectFeb 23, 2022

  • CVE-2020-27467
    35Monitor

    A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.

    HighCVSS 7.5Proof of conceptEPSS 15%

    processwire · processwireFeb 24, 2022

  • CVE-2021-44567
    46Plan

    An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNote

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    rosariosis · rosariosisFeb 24, 2022

  • CVE-2021-44967
    39Monitor

    A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote

    HighCVSS 8.8Proof of conceptEPSS 13%

    limesurvey · limesurveyFeb 24, 2022

  • CVE-2022-23176
    68This week

    WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged managemen

    HighCVSS 8.8KEVWeaponizedEPSS 10%

    watchguard · firewareFeb 24, 2022

  • CVE-2022-25072
    43Plan

    TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr().

    CriticalCVSS 9.8No exploitEPSS 13%

    tp-link · archer a54 firmwareFeb 24, 2022

  • CVE-2022-25073
    43Plan

    TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr().

    CriticalCVSS 9.8No exploitEPSS 13%

    tp-link · tl-wr841n firmwareFeb 24, 2022

  • CVE-2022-25074
    43Plan

    TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr().

    CriticalCVSS 9.8No exploitEPSS 13%

    tp-link · tl-wr902ac firmwareFeb 24, 2022

  • CVE-2022-25075
    56Plan

    TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function.

    CriticalCVSS 9.8No exploitEPSS 56%

    totolink · a3000ru firmwareFeb 24, 2022

  • CVE-2022-25077
    48Plan

    TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function.

    CriticalCVSS 9.8No exploitEPSS 30%

    totolink · a3100r firmwareFeb 24, 2022

  • CVE-2022-25082
    43Plan

    TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main"

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    totolink · a950rg firmwareFeb 24, 2022

  • CVE-2022-25084
    46Plan

    TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function.

    CriticalCVSS 9.8No exploitEPSS 21%

    totolink · t6 firmwareFeb 24, 2022

  • CVE-2022-25414
    42Plan

    Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the parameter NPTR.

    CriticalCVSS 9.8No exploitEPSS 10%

    tenda · ac9 firmwareFeb 24, 2022

  • CVE-2021-44532
    24Monitor

    Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format.

    MediumCVSS 5.3No exploitEPSS 10%

    nodejs · node.jsFeb 24, 2022

  • CVE-2022-0651
    40Plan

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

    HighCVSS 7.5Proof of conceptEPSS 32%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-21824
    38Monitor

    Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties

    HighCVSS 8.2No exploitEPSS 21%

    nodejs · node.jsFeb 24, 2022

  • CVE-2022-25148
    63This week

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-25149
    53Plan

    WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

    HighCVSS 7.5Proof of conceptEPSS 77%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2022-25305
    48Plan

    WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via IP

    MediumCVSS 6.1No exploitEPSS 78%

    veronalabs · wp statisticsFeb 24, 2022

  • CVE-2021-44664
    39Monitor

    An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading

    HighCVSS 8.8Proof of conceptEPSS 12%

    xerte · xerteFeb 24, 2022

  • CVE-2022-24288
    58Plan

    Apache Airflow: RCE in example DAGs

    HighCVSS 8.8Proof of conceptEPSS 77%

    apache · airflowFeb 25, 2022

  • CVE-2022-25060
    51Plan

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    tp-link · tl-wr840n firmwareFeb 25, 2022

  • CVE-2022-25061
    57Plan

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.

    CriticalCVSS 9.8Proof of conceptEPSS 58%

    tp-link · tl-wr840n firmwareFeb 25, 2022

  • CVE-2022-25064
    50Plan

    TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    tp-link · tl-wr840n firmwareFeb 25, 2022

  • CVE-2022-25094
    42Plan

    Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover

    HighCVSS 8.8No exploitEPSS 23%

    home owners collection management system project · home owners collection management systemFeb 25, 2022