rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-37077 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the pppoeUser parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:38.000Z
CVE-2022-37078 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the lang parameter at /setting/setLanguageCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:39.000Z
CVE-2022-37079 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:40.000Z
CVE-2022-37080 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the command parameter at setting/setTracerouteCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:41.000Z
CVE-2022-37081 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:41.000Z
CVE-2022-37082 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:42.000Z
CVE-2022-37083 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:43.000Z
CVE-2022-37084 
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the sPort parameter at the addEffect function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:44.000Z
CVE-2022-37085 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the AddWlanMacList function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:54.000Z
CVE-2022-37086 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Asp_SetTimingtimeWifiAndLed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:54.000Z
CVE-2022-37087 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetMobileAPInfoById.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:58.000Z
CVE-2022-37088 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetAP5GWifiById.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:59.000Z
CVE-2022-37089 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function EditMacList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:03:58.000Z
CVE-2022-37090 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:02.000Z
CVE-2022-37091 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function EditWlanMacList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:02.000Z
CVE-2022-37092 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetAPWifiorLedInfoById.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:05.000Z
CVE-2022-37093 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function AddMacList.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:12.000Z
CVE-2022-37094 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function Edit_BasicSSID_5G.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:12.000Z
CVE-2022-37095 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateWanParams.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:16.000Z
CVE-2022-37096 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function EnableIpv6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:16.000Z
CVE-2022-37097 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function SetAPInfoById.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:16.000Z
CVE-2022-37098 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateIpv6Params.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:19.000Z
CVE-2022-37099 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateSnat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:16.000Z
CVE-2022-37100 
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function UpdateMacClone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T14:04:23.000Z
CVE-2022-37108 
An injection vulnerability in the syslog-ng configuration wizard in Securonix Snypr 6.4 allows an application user with the "Manage Ingesters" permission to execute arbitrary code on remote ingesters by appending arbitrary text to text files that are executed by the system, such as users' crontab files. The patch for this was present in SNYPR version 6.4 Jun 2022 R3_[06170871], but may have been introduced sooner.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:N/I:H/PR:H/S:C/UI:N
version: 3.1
Published: 2022-09-07T13:06:27.000Z
CVE-2022-37109 
patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when password.txt is accessed can be bypassed. Furthermore, it is not necessary to crack the password hash to authenticate with the application because the password hash is also used as the cookie secret, so an attacker can generate his own authentication cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-14T00:00:00.000Z
CVE-2022-37111 
BlueCMS 1.6 has SQL injection in line 132 of admin/article.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T15:20:56.000Z
CVE-2022-37112 
BlueCMS 1.6 has SQL injection in line 55 of admin/model.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T15:19:00.000Z
CVE-2022-37113 
Bluecms 1.6 has SQL injection in line 132 of admin/area.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T15:17:18.000Z
CVE-2022-37122 
Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T15:47:57.000Z
CVE-2022-37123 
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/form2userconfig.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T22:59:58.000Z
CVE-2022-37125 
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T21:42:30.000Z
CVE-2022-37128 
In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T18:54:22.000Z
CVE-2022-37129 
D-Link DIR-816 A2_v1.10CNB04.img is vulnerable to Command Injection via /goform/SystemCommand. After the user passes in the command parameter, it will be spliced into byte_4836B0 by snprintf, and finally doSystem(&byte_4836B0); will be executed, resulting in a command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T22:44:57.000Z
CVE-2022-37130 
In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T00:00:00.000Z
CVE-2022-37133 
D-link DIR-816 A2_v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot is executed when the function returns at the end.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T14:44:22.000Z
CVE-2022-37134 
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Buffer Overflow via /goform/form2Wan.cgi. When wantype is 3, l2tp_usrname will be decrypted by base64, and the result will be stored in v94, which does not check the size of l2tp_usrname, resulting in stack overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-22T14:41:44.000Z
CVE-2022-37137 
PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the view ticket function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T03:24:01.000Z
CVE-2022-37138 
Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as Administrator after injecting username form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T03:37:43.000Z
CVE-2022-37139 
Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T03:31:46.000Z
CVE-2022-37140 
PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T03:41:09.000Z
CVE-2022-37144 
The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T00:27:59.000Z
CVE-2022-37145 
The PlexTrac platform prior to version 1.17.0 does not restrict excessive authentication attempts for accounts configured to use the PlexTrac authentication provider. An unauthenticated remote attacker could perform a bruteforce attack on the login page with no time or attempt limitation in an attempt to obtain valid credentials for the platform users configured to use the PlexTrac authentication provider.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T00:28:04.000Z
CVE-2022-37146 
The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider take significantly longer than those for invalid users, allowing for valid users to be enumerated by an unauthenticated remote attacker. Note that the lockout policy implemented in Plextrac version 1.17.0 makes it impossible to distinguish between valid, locked user accounts and user accounts that do not exist, but does not prevent valid, unlocked users from being enumerated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T00:28:09.000Z
CVE-2022-37149 
WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows attackers to execute arbitrary commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T14:39:02.000Z
CVE-2022-37150 
An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gender, email, contact parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-26T12:15:03.000Z
CVE-2022-37151 
There is an unauthorized access vulnerability in Online Diagnostic Lab Management System 1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-26T12:23:15.000Z
CVE-2022-37152 
An issue was discovered in Online Diagnostic Lab Management System 1.0, There is a SQL injection vulnerability via "dob" parameter in "/classes/Users.php?f=save_client"
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-26T12:17:49.000Z
CVE-2022-37153 
An issue was discovered in Artica Proxy 4.30.000000. There is a XSS vulnerability via the password parameter in /fw.login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-24T12:22:56.000Z
CVE-2022-37155 
RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-37158 
RuoYi v3.8.3 has a Weak password vulnerability in the management system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T16:06:59.000Z
CVE-2022-37159 
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T16:26:37.000Z
CVE-2022-37160 
Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T16:29:01.000Z
CVE-2022-37161 
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T16:21:28.000Z
CVE-2022-37162 
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T16:19:42.000Z
CVE-2022-37163 
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T15:16:50.000Z
CVE-2022-37164 
Inoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-08T15:16:56.000Z
CVE-2022-37172 
Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:05:56.000Z
CVE-2022-37173 
An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T20:05:57.000Z
CVE-2022-37175 
Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T20:50:21.000Z
CVE-2022-37176 
Tenda AC6(AC1200) v5.0 Firmware v02.03.01.114 and below contains a vulnerability which allows attackers to remove the Wi-Fi password and force the device into open security mode via a crafted packet sent to goform/setWizard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-30T15:07:40.000Z
CVE-2022-37177 
HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T00:00:00.000Z
CVE-2022-37178 
An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-24T16:34:24.000Z
CVE-2022-37181 
72crm 9.0 has an Arbitrary file upload vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-24T16:31:52.000Z
CVE-2022-37183 
Piwigo 12.3.0 is vulnerable to Cross Site Scripting (XSS) via /search/1940/created-monthly-list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T17:09:50.000Z
CVE-2022-37184 
The application manage_website.php on Garage Management System 1.0 is vulnerable to Shell File Upload. The already authenticated malicious user, can upload a dangerous RCE or LCE exploit file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T17:18:02.000Z
CVE-2022-37185 
SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the Thai Basic Education Commission, which can lead to data leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-06T19:28:44.000Z
CVE-2022-37186 
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-37189 
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-07T12:34:59.000Z
CVE-2022-37190 
CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:07:14.000Z
CVE-2022-37191 
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-13T22:07:19.000Z
CVE-2022-37193 
Chipolo ONE Bluetooth tracker (2020) Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T12:54:21.000Z
CVE-2022-37197 
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-37199 
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-23T12:54:01.000Z
CVE-2022-37201 
JFinal CMS 5.1.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T15:03:37.000Z
CVE-2022-37202 
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-26T00:00:00.000Z
CVE-2022-37203 
JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:26:22.000Z
CVE-2022-37204 
Final CMS 5.1.0 is vulnerable to SQL Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T16:58:31.000Z
CVE-2022-37205 
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T17:40:08.000Z
CVE-2022-37207 
JFinal CMS 5.1.0 is affected by: SQL Injection. These interfaces do not use the same component, nor do they have filters, but each uses its own SQL concatenation method, resulting in SQL injection
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T14:34:24.000Z