Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2022

103 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2022-25017
    44Plan

    Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.

    HighCVSS 8.8No exploitEPSS 29%

    hitrontech · chita firmwareApr 1, 2022

  • CVE-2022-22963
    99Now

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · spring cloud functionApr 1, 2022

  • CVE-2022-22965
    99Now

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · spring frameworkApr 1, 2022

  • CVE-2022-22950
    37Monitor

    n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL exp

    MediumCVSS 6.5No exploitEPSS 36%

    vmware · spring frameworkApr 1, 2022

  • CVE-2022-28368
    64This week

    Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (with

    CriticalCVSS 9.8WeaponizedEPSS 82%

    dompdf project · dompdfApr 2, 2022

  • CVE-2022-28379
    40Plan

    jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.

    MediumCVSS 4.8No exploitEPSS 71%

    nginxproxymanager · nginx proxy managerApr 3, 2022

  • CVE-2022-28381
    60This week

    Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long st

    CriticalCVSS 9.8WeaponizedEPSS 70%

    allmediaserver · allmediaserverApr 3, 2022

  • CVE-2022-26233
    35Monitor

    Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to acc

    HighCVSS 7.5Proof of conceptEPSS 15%

    barco · control room management suiteApr 3, 2022

  • CVE-2021-44138
    34Monitor

    There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read

    HighCVSS 7.5Proof of conceptEPSS 12%

    caucho · resinApr 4, 2022

  • CVE-2022-1026
    38Monitor

    Kyocera Net View Address Book Exposure

    HighCVSS 8.6Proof of conceptEPSS 14%

    kyocera · net viewerApr 4, 2022

  • CVE-2022-24785
    34Monitor

    Path Traversal in Moment.js

    HighCVSS 7.5Proof of conceptEPSS 13%

    momentjs · momentApr 4, 2022

  • CVE-2022-1162
    62This week

    A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    gitlab · gitlabApr 4, 2022

  • CVE-2022-1175
    49Plan

    Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio

    MediumCVSS 6.1Proof of conceptEPSS 82%

    gitlab · gitlabApr 4, 2022

  • CVE-2022-1190
    47Plan

    Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an atta

    MediumCVSS 5.4No exploitEPSS 87%

    gitlab · gitlabApr 4, 2022

  • CVE-2022-0609
    72This week

    Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a c

    HighCVSS 8.8KEVWeaponizedEPSS 22%

    google · chromeApr 4, 2022

  • CVE-2021-43008
    34Monitor

    Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on th

    HighCVSS 7.5Proof of conceptEPSS 13%

    adminer · adminerApr 4, 2022

  • CVE-2022-26635
    45Plan

    PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection.

    CriticalCVSS 9.8No exploitEPSS 21%

    php · memcachedApr 5, 2022

  • CVE-2022-28219
    68This week

    Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.

    CriticalCVSS 9.8WeaponizedEPSS 97%

    zohocorp · manageengine adaudit plusApr 5, 2022

  • CVE-2022-26250
    31Monitor

    Synaman v5.1 and below was discovered to contain weak file permissions which allows authenticated attackers to escalate privileges.

    HighCVSS 7.8No exploitEPSS 0%

    synametrics · synamanApr 5, 2022

  • CVE-2022-26251
    29Monitor

    The HTTP interface of Synaman v5.1 and below was discovered to allow authenticated attackers to execute arbitrary code and escalate privileg

    HighCVSS 7.2No exploitEPSS 1%

    synametrics · synamanApr 5, 2022

  • CVE-2021-30497
    59Plan

    Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal.

    HighCVSS 7.5Proof of conceptEPSS 96%

    ivanti · avalancheApr 5, 2022

  • CVE-2021-46417
    48Plan

    Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fuelin

    HighCVSS 7.5Proof of conceptEPSS 59%

    franklinfueling · colibri firmwareApr 7, 2022

  • CVE-2021-46418
    37Monitor

    An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

    HighCVSS 7.5Proof of conceptEPSS 23%

    telesquare · tlr-2855ks6 firmwareApr 7, 2022

  • CVE-2021-46419
    57Plan

    An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.

    CriticalCVSS 9.1Proof of conceptEPSS 71%

    telesquare · tlr-2855ks6 firmwareApr 7, 2022

  • CVE-2021-43421
    52Plan

    A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    std42 · elfinderApr 7, 2022

  • CVE-2021-46367
    37Monitor

    RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel.

    HighCVSS 7.2No exploitEPSS 29%

    ritecms · ritecmsApr 8, 2022

  • CVE-2022-27115
    48Plan

    In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.

    CriticalCVSS 9.8No exploitEPSS 28%

    std42 · elfinderApr 11, 2022

  • CVE-2022-22954
    99Now

    VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · identity managerApr 11, 2022

  • CVE-2022-24838
    49Plan

    Command Injection in Appointment Emails for Nextcloud Calendar

    CriticalCVSS 9.8No exploitEPSS 33%

    nextcloud · calendarApr 11, 2022

  • CVE-2022-28346
    45Plan

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    djangoproject · djangoApr 12, 2022

  • CVE-2022-23450
    50Plan

    A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions

    CriticalCVSS 9.8No exploitEPSS 35%

    siemens · simatic energy manager basicApr 12, 2022

  • CVE-2022-24248
    32Monitor

    RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel.

    MediumCVSS 6.5No exploitEPSS 20%

    ritecms · ritecmsApr 12, 2022

  • CVE-2021-31805
    65This week

    Forced OGNL evaluation, when evaluated on raw not validated user input in tag attributes, may lead to RCE.

    CriticalCVSS 9.8Proof of conceptEPSS 85%

    apache · strutsApr 12, 2022

  • CVE-2022-28213
    36Monitor

    When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently vali

    HighCVSS 8.1Proof of conceptEPSS 12%

    sap · businessobjects business intelligence platformApr 12, 2022

  • CVE-2022-29036
    43Plan

    Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does n

    MediumCVSS 5.4No exploitEPSS 71%

    jenkins · credentialsApr 12, 2022

  • CVE-2021-22797
    39Monitor

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious scri

    HighCVSS 7.8No exploitEPSS 26%

    schneider-electric · ecostruxure control expertApr 13, 2022

  • CVE-2022-22956
    60This week

    VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.

    CriticalCVSS 9.8WeaponizedEPSS 49%

    vmware · identity managerApr 13, 2022

  • CVE-2022-22957
    40Plan

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CV

    HighCVSS 7.2WeaponizedEPSS 23%

    vmware · cloud foundationApr 13, 2022

  • CVE-2022-22960
    72This week

    VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissio

    HighCVSS 7.8KEVWeaponizedEPSS 35%

    vmware · cloud foundationApr 13, 2022

  • CVE-2022-24816
    100Now

    Improper Control of Generation of Code in jai-ext

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    geosolutionsgroup · jai-extApr 13, 2022

  • CVE-2021-43287
    38Monitor

    An issue was discovered in ThoughtWorks GoCD before 21.3.0.

    HighCVSS 7.5Proof of conceptEPSS 27%

    thoughtworks · gocdApr 14, 2022

  • CVE-2022-21145
    42Plan

    A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    MediumCVSS 4.8No exploitEPSS 77%

    lansweeper · lansweeperApr 14, 2022

  • CVE-2022-21210
    56Plan

    An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    HighCVSS 8.8No exploitEPSS 71%

    lansweeper · lansweeperApr 14, 2022

  • CVE-2022-21234
    57Plan

    An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    HighCVSS 8.8No exploitEPSS 72%

    lansweeper · lansweeperApr 14, 2022

  • CVE-2022-22149
    57Plan

    A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.

    HighCVSS 8.8No exploitEPSS 72%

    lansweeper · lansweeperApr 14, 2022

  • CVE-2022-26498
    35Monitor

    An issue was discovered in Asterisk through 19.x.

    HighCVSS 7.5No exploitEPSS 16%

    digium · asteriskApr 15, 2022

  • CVE-2022-27474
    35Monitor

    SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.

    HighCVSS 7.2No exploitEPSS 23%

    salesagility · suitecrmApr 15, 2022

  • CVE-2022-20695
    46Plan

    Cisco Wireless LAN Controller Management Interface Authentication Bypass Vulnerability

    CriticalCVSS 10.0No exploitEPSS 19%

    cisco · wireless lan controller 8.10.151.0Apr 15, 2022

  • CVE-2022-24481
    36Monitor

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 16%

    microsoft · windows 10Apr 15, 2022

  • CVE-2022-24491
    49Plan

    Windows Network File System Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 33%

    microsoft · windows 10Apr 15, 2022

  • CVE-2022-24497
    49Plan

    Windows Network File System Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    microsoft · windows 10Apr 15, 2022

  • CVE-2022-24500
    46Plan

    Windows SMB Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 38%

    microsoft · windows 10Apr 15, 2022

  • CVE-2022-24521
    63This week

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 7%

    microsoft · windows 10 1507Apr 15, 2022

  • CVE-2022-26809
    66This week

    Remote Procedure Call Runtime Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 90%

    microsoft · windows 10Apr 15, 2022

  • CVE-2022-26904
    63This week

    Windows User Profile Service Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 16%

    microsoft · windows 10 1507Apr 15, 2022

  • CVE-2022-27908
    46Plan

    Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.

    HighCVSS 8.8No exploitEPSS 36%

    zohocorp · manageengine opmanagerApr 18, 2022

  • CVE-2022-28810
    78This week

    Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS command

    MediumCVSS 6.8KEVWeaponizedEPSS 70%

    zohocorp · manageengine adselfservice plusApr 18, 2022

  • CVE-2020-35632
    36Monitor

    Multiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.

    HighCVSS 8.8No exploitEPSS 2%

    cgal · computational geometry algorithms libraryApr 18, 2022

  • CVE-2022-25226
    43Plan

    ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obta

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    cybelsoft · thinvncApr 18, 2022

  • CVE-2022-0661
    40Plan

    Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE

    HighCVSS 7.2No exploitEPSS 40%

    ad injection project · ad injectionApr 18, 2022

  • CVE-2022-1020
    47Plan

    Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    codeastrology · woo product tableApr 18, 2022

  • CVE-2022-29464
    99Now

    Certain WSO2 products allow unrestricted file upload with resultant remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    wso2 · api managerApr 18, 2022

  • CVE-2022-28108
    42Plan

    Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/f

    HighCVSS 8.8Proof of conceptEPSS 22%

    selenium · selenium gridApr 18, 2022

  • CVE-2022-27927
    43Plan

    A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database.

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    microfinance management system project · microfinance management systemApr 19, 2022

  • CVE-2022-1119
    36Monitor

    Simple File List <= 3.2.7 - Arbitrary File Download

    HighCVSS 7.5Proof of conceptEPSS 19%

    simplefilelist · simple-file-listApr 19, 2022

  • CVE-2022-1329
    63This week

    Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

    HighCVSS 8.8WeaponizedEPSS 92%

    elementor · website builderApr 19, 2022

  • CVE-2022-21445
    88Now

    Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces).

    CriticalCVSS 9.8KEVWeaponizedEPSS 62%

    oracle · application development frameworkApr 19, 2022

  • CVE-2022-21449
    53Plan

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

    HighCVSS 7.5Proof of conceptEPSS 77%

    oracle · graalvmApr 19, 2022

  • CVE-2022-21489
    49Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 78%

    oracle · mysqlApr 19, 2022

  • CVE-2022-21490
    49Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 79%

    oracle · mysql clusterApr 19, 2022

  • CVE-2022-0540
    65This week

    A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP reques

    CriticalCVSS 9.8Proof of conceptEPSS 88%

    atlassian · jira data centerApr 20, 2022

  • CVE-2022-26133
    60This week

    SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6

    CriticalCVSS 9.8Proof of conceptEPSS 70%

    atlassian · bitbucket data centerApr 20, 2022

  • CVE-2022-27926
    60This week

    A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allo

    MediumCVSS 6.1KEVWeaponizedEPSS 17%

    synacor · zimbra collaboration suiteApr 20, 2022

  • CVE-2022-29548
    36Monitor

    A reflected XSS issue exists in the Management Console of several WSO2 products.

    MediumCVSS 6.1Proof of conceptEPSS 41%

    wso2 · api managerApr 20, 2022

  • CVE-2022-27924
    88Now

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted insta

    HighCVSS 7.5KEVWeaponizedEPSS 93%

    synacor · zimbra collaboration suiteApr 21, 2022

  • CVE-2022-27925
    88Now

    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it.

    HighCVSS 7.2KEVWeaponizedEPSS 98%

    synacor · zimbra collaboration suiteApr 21, 2022

  • CVE-2022-27478
    41Plan

    Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.

    HighCVSS 8.8No exploitEPSS 20%

    victor cms project · victor cmsApr 21, 2022

  • CVE-2022-28021
    46Plan

    Purchase Order Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via /purchase_order/admin/?page=

    CriticalCVSS 9.8No exploitEPSS 24%

    purchase order management system project · purchase order management systemApr 21, 2022

  • CVE-2022-1429
    49Plan

    SQL injection in GridHelperService.php in pimcore/pimcore

    HighCVSS 7.5No exploitEPSS 63%

    pimcore · pimcoreApr 22, 2022

  • CVE-2021-45837
    60This week

    It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically c

    CriticalCVSS 9.8WeaponizedEPSS 16%

    terra-master · tosApr 25, 2022

  • CVE-2021-45839
    40Plan

    It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) as

    MediumCVSS 6.5WeaponizedEPSS 9%

    terra-master · tosApr 25, 2022

  • CVE-2021-45841
    60This week

    In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the target's MAC address a

    HighCVSS 8.1WeaponizedEPSS 8%

    terra-master · tosApr 25, 2022

  • CVE-2022-29078
    49Plan

    The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][output

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    ejs · ejsApr 25, 2022

  • CVE-2021-25094
    60This week

    Tatsu < 3.3.12 - Unauthenticated RCE

    HighCVSS 8.1WeaponizedEPSS 83%

    brandexponents · tatsuApr 25, 2022

  • CVE-2022-1390
    46Plan

    Admin Word Count Column <= 2.2 - Unauthenticated Arbitrary File Read

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    admin word count column project · admin word count columnApr 25, 2022

  • CVE-2022-1391
    44Plan

    Cab fare calculator < 1.0.4 - Unauthenticated LFI

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    kanev · cab fare calculatorApr 25, 2022

  • CVE-2022-1392
    33Monitor

    Videos sync PDF <= 1.7.4 - Unauthenticated LFI

    HighCVSS 7.5Proof of conceptEPSS 11%

    commoninja · videos sync pdfApr 25, 2022

  • CVE-2021-35250
    34Monitor

    Directory Transversal Vulnerability in Serv-U 15.3

    HighCVSS 7.5Proof of conceptEPSS 12%

    solarwinds · serv-uApr 25, 2022

  • CVE-2022-29499
    86Now

    The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.

    CriticalCVSS 9.8KEVWeaponizedEPSS 55%

    mitel · mivoice connectApr 25, 2022

  • CVE-2022-29806
    60This week

    ZoneMinder before 1.36.13 allows remote code execution via an invalid language.

    CriticalCVSS 9.8WeaponizedEPSS 67%

    zoneminder · zoneminderApr 26, 2022

  • CVE-2022-24706
    97Now

    Remote Code Execution Vulnerability in Packaging

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    apache · couchdbApr 26, 2022

  • CVE-2021-46441
    45Plan

    In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" parameters to execute ar

    HighCVSS 8.8No exploitEPSS 32%

    dlink · dir-825 firmwareApr 27, 2022

  • CVE-2021-46442
    56Plan

    In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions

    CriticalCVSS 9.8No exploitEPSS 56%

    dlink · dir-825 firmwareApr 27, 2022

  • CVE-2021-46422
    67This week

    Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without

    CriticalCVSS 9.8Proof of conceptEPSS 94%

    telesquare · sdt-cs3b1 firmwareApr 27, 2022

  • CVE-2021-46424
    47Plan

    Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even

    CriticalCVSS 9.1Proof of conceptEPSS 36%

    telesquare · tlr-2005ksh firmwareApr 27, 2022

  • CVE-2022-27336
    45Plan

    Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.

    CriticalCVSS 9.8No exploitEPSS 20%

    seacms · seacmsApr 27, 2022

  • CVE-2022-24735
    32Monitor

    Lua scripts can be manipulated to overcome ACL rules in Redis

    HighCVSS 7.8No exploitEPSS 2%

    redis · redisApr 27, 2022

  • CVE-2022-28117
    26Monitor

    A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make ar

    MediumCVSS 4.9Proof of conceptEPSS 22%

    naviwebs · navigate cmsApr 28, 2022

  • CVE-2022-29081
    64This week

    Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-contro

    CriticalCVSS 9.8Proof of conceptEPSS 83%

    zohocorp · manageengine access manager plusApr 28, 2022

  • CVE-2022-29904
    44Plan

    The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with cer

    CriticalCVSS 9.8No exploitEPSS 16%

    mediawiki · mediawikiApr 29, 2022