Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2022

125 records · 9 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2022-25647
    34Monitor

    Deserialization of Untrusted Data

    HighCVSS 7.5No exploitEPSS 12%

    google · gsonMay 1, 2022

  • CVE-2021-40822
    36Monitor

    GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

    HighCVSS 7.5Proof of conceptEPSS 19%

    osgeo · geoserverMay 1, 2022

  • CVE-2022-28054
    49Plan

    Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via

    CriticalCVSS 9.8No exploitEPSS 31%

    vandyke · vshellMay 2, 2022

  • CVE-2022-28573
    47Plan

    D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting.

    CriticalCVSS 9.8No exploitEPSS 28%

    dlink · dir-823 pro firmwareMay 2, 2022

  • CVE-2022-0773
    52Plan

    Documentor <= 1.5.3 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    documentor project · documentorMay 2, 2022

  • CVE-2022-0952
    38Monitor

    Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update

    HighCVSS 8.8Proof of conceptEPSS 11%

    sitemap project · sitemapMay 2, 2022

  • CVE-2022-1281
    52Plan

    Photo Gallery < 1.6.3 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 43%

    10web · photo galleryMay 2, 2022

  • CVE-2022-1366
    45Plan

    Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx.

    CriticalCVSS 9.8No exploitEPSS 19%

    deltaww · diaenergieMay 2, 2022

  • CVE-2022-1367
    45Plan

    Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx.

    CriticalCVSS 9.8No exploitEPSS 19%

    deltaww · diaenergieMay 2, 2022

  • CVE-2022-1378
    45Plan

    Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx.

    CriticalCVSS 9.8No exploitEPSS 19%

    deltaww · diaenergieMay 2, 2022

  • CVE-2022-20759
    44Plan

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Privilege Escalation Vulnerability

    HighCVSS 8.8No exploitEPSS 28%

    cisco · secure firewall threat defenseMay 3, 2022

  • CVE-2021-42165
    39Monitor

    MitraStar GPT-2541GNAC-N1 (HGU) 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo s

    HighCVSS 8.8Proof of conceptEPSS 14%

    mitrastar · gpt-2541gnac-n1 firmwareMay 3, 2022

  • CVE-2022-28590
    35Monitor

    A Remote Code Execution (RCE) vulnerability exists in Pixelimity 1.0 via admin/admin-ajax.php?action=install_theme.

    HighCVSS 7.2Proof of conceptEPSS 23%

    pixelimity · pixelimityMay 3, 2022

  • CVE-2022-28561
    42Plan

    There is a stack overflow vulnerability in the /goform/setMacFilterCfg function in the httpd service of Tenda ax12 22.03.01.21_cn router.

    CriticalCVSS 9.8No exploitEPSS 10%

    tenda · ax12 firmwareMay 3, 2022

  • CVE-2022-1292
    54Plan

    The c_rehash script allows command injection

    HighCVSS 7.3Proof of conceptEPSS 82%

    siemens · brownfield connectivity gatewayMay 3, 2022

  • CVE-2021-43164
    46Plan

    A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55

    HighCVSS 8.8Proof of conceptEPSS 35%

    ruijienetworks · reyeeosMay 3, 2022

  • CVE-2021-42192
    38Monitor

    Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.

    HighCVSS 8.8Proof of conceptEPSS 10%

    konga project · kongaMay 4, 2022

  • CVE-2022-28096
    34Monitor

    Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.

    HighCVSS 7.2No exploitEPSS 20%

    skycaiji · skycaijiMay 4, 2022

  • CVE-2022-28557
    46Plan

    There is a command injection vulnerability at the /goform/setsambacfg interface of Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin dev

    CriticalCVSS 9.8No exploitEPSS 22%

    tenda · ac15 firmwareMay 4, 2022

  • CVE-2022-20777
    42Plan

    Cisco Enterprise NFV Infrastructure Software Vulnerabilities

    CriticalCVSS 9.9No exploitEPSS 11%

    cisco · enterprise nfv infrastructure softwareMay 4, 2022

  • CVE-2022-20779
    38Monitor

    Cisco Enterprise NFV Infrastructure Software Vulnerabilities

    HighCVSS 8.8No exploitEPSS 10%

    cisco · enterprise nfv infrastructure softwareMay 4, 2022

  • CVE-2022-20780
    32Monitor

    Cisco Enterprise NFV Infrastructure Software Vulnerabilities

    HighCVSS 7.4No exploitEPSS 11%

    cisco · enterprise nfv infrastructure softwareMay 4, 2022

  • CVE-2022-29155
    58Plan

    In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, vi

    CriticalCVSS 9.8No exploitEPSS 64%

    openldap · openldapMay 4, 2022

  • CVE-2022-1388
    99Now

    On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    f5 · big-ip access policy managerMay 5, 2022

  • CVE-2022-28079
    44Plan

    College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.

    HighCVSS 8.8Proof of conceptEPSS 28%

    college management system project · college management systemMay 5, 2022

  • CVE-2022-28080
    52Plan

    Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.

    HighCVSS 8.8Proof of conceptEPSS 56%

    event management system project · event management systemMay 5, 2022

  • CVE-2022-29592
    45Plan

    Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route).

    CriticalCVSS 9.8No exploitEPSS 20%

    tenda · tx9 pro firmwareMay 5, 2022

  • CVE-2022-29535
    67This week

    Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.

    CriticalCVSS 9.8No exploitEPSS 91%

    zohocorp · manageengine opmanagerMay 5, 2022

  • CVE-2022-30295
    29Monitor

    uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning.

    MediumCVSS 6.5No exploitEPSS 11%

    uclibc · uclibcMay 6, 2022

  • CVE-2020-19213
    44Plan

    SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.

    CriticalCVSS 9.8No exploitEPSS 15%

    piwigo · piwigoMay 6, 2022

  • CVE-2022-30333
    90Now

    RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonst

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    rarlab · unrarMay 9, 2022

  • CVE-2022-30286
    34Monitor

    pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code.

    HighCVSS 7.5Proof of conceptEPSS 13%

    pyscript · pyscriptMay 9, 2022

  • CVE-2022-0592
    42Plan

    MapSVG < 6.2.20 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    mapsvg · mapsvgMay 9, 2022

  • CVE-2022-0817
    42Plan

    BadgeOS <= 3.7.0 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    badgeos · badgeosMay 9, 2022

  • CVE-2022-1104
    36Monitor

    Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting

    MediumCVSS 4.8Proof of conceptEPSS 56%

    code-atlantic · popup makerMay 9, 2022

  • CVE-2022-29933
    36Monitor

    Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an

    HighCVSS 8.8No exploitEPSS 4%

    craftcms · craft cmsMay 9, 2022

  • CVE-2022-29322
    44Plan

    D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the IPADDR and nvmacaddr parameters in /goform/form2Dhcpip.

    CriticalCVSS 9.8No exploitEPSS 16%

    dlink · dir-816 firmwareMay 10, 2022

  • CVE-2022-29328
    43Plan

    D-Link DAP-1330_OSS-firmware_1.00b21 was discovered to contain a stack overflow via the function checkvalidupgrade.

    CriticalCVSS 9.8No exploitEPSS 13%

    dlink · dap-1330 firmwareMay 10, 2022

  • CVE-2022-29329
    43Plan

    D-Link DAP-1330_OSS-firmware_1.00b21 was discovered to contain a heap overflow via the devicename parameter in /goform/setDeviceSettings.

    CriticalCVSS 9.8No exploitEPSS 13%

    dlink · dap-1330 firmwareMay 10, 2022

  • CVE-2022-23676
    46Plan

    A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versi

    CriticalCVSS 9.8No exploitEPSS 22%

    arubanetworks · 5406r firmwareMay 10, 2022

  • CVE-2022-23677
    38Monitor

    A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versi

    HighCVSS 8.1No exploitEPSS 20%

    arubanetworks · 5406r firmwareMay 10, 2022

  • CVE-2022-1476
    40Plan

    All-in-One WP Migration <= 7.58 - Directory Traversal to File Deletion on Windows Hosts

    MediumCVSS 6.5No exploitEPSS 46%

    servmask · all-in-one wp migrationMay 10, 2022

  • CVE-2022-21972
    56Plan

    Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 79%

    microsoft · windows 10May 10, 2022

  • CVE-2022-22017
    46Plan

    Remote Desktop Client Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 37%

    microsoft · remote desktop clientMay 10, 2022

  • CVE-2022-23270
    53Plan

    Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

    HighCVSS 8.1Proof of conceptEPSS 70%

    microsoft · windows 10May 10, 2022

  • CVE-2022-26923
    90Now

    Active Directory Domain Services Elevation of Privilege Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 83%

    microsoft · windows 10 1507May 10, 2022

  • CVE-2022-26925
    60This week

    Windows LSA Spoofing Vulnerability

    MediumCVSS 5.9KEVWeaponizedEPSS 10%

    microsoft · windows 10 1507May 10, 2022

  • CVE-2022-26937
    62This week

    Windows Network File System Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    microsoft · windows serverMay 10, 2022

  • CVE-2022-29104
    35Monitor

    Windows Print Spooler Elevation of Privilege Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10May 10, 2022

  • CVE-2022-29108
    38Monitor

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · sharepoint enterprise serverMay 10, 2022

  • CVE-2022-30129
    47Plan

    Visual Studio Code Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 41%

    microsoft · visual studio codeMay 10, 2022

  • CVE-2022-29006
    45Plan

    Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allow

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    phpgurukul · directory management systemMay 11, 2022

  • CVE-2022-29007
    45Plan

    Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    phpgurukul · dairy farm shop management systemMay 11, 2022

  • CVE-2022-29009
    46Plan

    Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    phpgurukul · cyber cafe management systemMay 11, 2022

  • CVE-2022-24102
    35Monitor

    Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-24104
    34Monitor

    Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27785
    35Monitor

    Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27786
    35Monitor

    Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27787
    34Monitor

    Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 10%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27790
    35Monitor

    Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27791
    36Monitor

    Adobe Acrobat Reader DC Font Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 17%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27794
    35Monitor

    Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 14%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27796
    35Monitor

    Adobe Acrobat Reader DC AcroForm isBoxChecked Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-27799
    37Monitor

    Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 18%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28230
    35Monitor

    Adobe Acrobat Reader DC AcroForm calculateNow Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28232
    35Monitor

    Adobe Acrobat Reader DC Collab Object Use-After-Free Information Disclosure Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28233
    35Monitor

    Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28236
    34Monitor

    Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28238
    35Monitor

    Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28240
    35Monitor

    Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28243
    34Monitor

    Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 10%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28246
    25Monitor

    Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 10%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28258
    25Monitor

    Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 10%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-28269
    16Monitor

    Adobe Acrobat Reader DC Annotation Use-After-Free Information Disclosure Vulnerability

    LowCVSS 3.3No exploitEPSS 10%

    adobe · acrobat dcMay 11, 2022

  • CVE-2022-29845
    40Plan

    In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction t

    MediumCVSS 6.5WeaponizedEPSS 4%

    progress · whatsup goldMay 11, 2022

  • CVE-2022-29846
    60This week

    In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold

    MediumCVSS 5.3WeaponizedEPSS 5%

    progress · whatsup goldMay 11, 2022

  • CVE-2022-29847
    60This week

    In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transac

    HighCVSS 7.5WeaponizedEPSS 57%

    progress · whatsup goldMay 11, 2022

  • CVE-2022-29848
    40Plan

    In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction t

    MediumCVSS 6.5WeaponizedEPSS 3%

    progress · whatsup goldMay 11, 2022

  • CVE-2022-30453
    44Plan

    ShopWind <= 3.4.2 has a RCE vulnerability in Database.php

    CriticalCVSS 9.8No exploitEPSS 15%

    shopwind · shopwindMay 11, 2022

  • CVE-2022-30063
    44Plan

    ftcms <=2.1 was discovered to be vulnerable to code execution attacks .

    CriticalCVSS 9.8No exploitEPSS 17%

    ftcms · ftcmsMay 11, 2022

  • CVE-2022-30450
    45Plan

    A Remote Code Execution (RCE) vulnerability exists in waimairen 9.1 via wx.php

    CriticalCVSS 9.8No exploitEPSS 21%

    waimairencms project · waimairencmsMay 11, 2022

  • CVE-2022-29885
    52Plan

    EncryptInterceptor does not provide complete protection on insecure networks

    HighCVSS 7.5Proof of conceptEPSS 73%

    apache · tomcatMay 12, 2022

  • CVE-2022-30525
    99Now

    A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 f

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    zyxel · usg flex 100w firmwareMay 12, 2022

  • CVE-2022-29298
    44Plan

    SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.

    HighCVSS 7.5Proof of conceptEPSS 46%

    contec · sv-cpt-mc310 firmwareMay 12, 2022

  • CVE-2022-29303
    98Now

    SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    contec · sv-cpt-mc310 firmwareMay 12, 2022

  • CVE-2022-29307
    44Plan

    IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang

    CriticalCVSS 9.8No exploitEPSS 18%

    ionizecms · ionizeMay 12, 2022

  • CVE-2022-26085
    39Monitor

    An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4.

    HighCVSS 8.8No exploitEPSS 12%

    inhandnetworks · ir302 firmwareMay 12, 2022

  • CVE-2022-28818
    37Monitor

    ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution

    MediumCVSS 6.1No exploitEPSS 44%

    adobe · coldfusionMay 12, 2022

  • CVE-2022-29383
    54Plan

    NETGEAR ProSafe SSL VPN firmware FVS336Gv2 and FVS336Gv3 was discovered to contain a SQL injection vulnerability via USERDBDomains.Domainnam

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    netgear · ssl312 firmwareMay 13, 2022

  • CVE-2022-30781
    60This week

    Gitea before 1.16.7 does not escape git fetch remote.

    HighCVSS 7.5WeaponizedEPSS 87%

    gitea · giteaMay 16, 2022

  • CVE-2022-30011
    45Plan

    In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability.

    CriticalCVSS 9.8No exploitEPSS 18%

    hospital management system project · hospital management systemMay 16, 2022

  • CVE-2022-0867
    43Plan

    ARPrice Lite < 3.6.1 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    reputeinfosystems · pricing tableMay 16, 2022

  • CVE-2022-1103
    40Plan

    Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 15%

    advanced uploader project · advanced uploaderMay 16, 2022

  • CVE-2022-1386
    60This week

    Fusion Builder < 3.6.2 - Unauthenticated SSRF

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    fusion builder project · fusion builderMay 16, 2022

  • CVE-2022-30956
    43Plan

    Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scr

    MediumCVSS 5.4No exploitEPSS 73%

    jenkins · rundeckMay 17, 2022

  • CVE-2022-24108
    49Plan

    The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter

    CriticalCVSS 9.8No exploitEPSS 32%

    skyoftech · so listing tabsMay 17, 2022

  • CVE-2022-24856
    33Monitor

    Server-Side Request Forgery in FlyteConsole

    HighCVSS 7.5Proof of conceptEPSS 10%

    flyte · flyte consoleMay 17, 2022

  • CVE-2022-1118
    34Monitor

    Rockwell Automation ISaGRAF Deserialization of Untrusted Data

    HighCVSS 7.8No exploitEPSS 11%

    rockwellautomation · connected component workbenchMay 17, 2022

  • CVE-2022-28955
    42Plan

    An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.

    HighCVSS 7.5Proof of conceptEPSS 39%

    dlink · dir-816l firmwareMay 18, 2022

  • CVE-2022-28956
    46Plan

    An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.

    CriticalCVSS 9.8No exploitEPSS 22%

    dlink · dir-816l firmwareMay 18, 2022