rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-28339 
Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro HouseCall for Home Networks
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: 2025-02-22T20:51:10.611Z
CVE-2022-28345 
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send legitimate looking links, appearing to be any website URL, by abusing the non-http/non-https automatic rendering of URLs. An attacker can spoof, for example, example.com, and masquerade any URL with a malicious destination. An attacker requires a subdomain such as gepj, txt, fdp, or xcod, which would appear backwards as jpeg, txt, pdf, and docx respectively.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-15T05:28:57.000Z
CVE-2022-28346 
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-12T00:00:00.000Z
CVE-2022-28347 
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-12T00:00:00.000Z
CVE-2022-28348 
Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p0) allows improper GPU memory operations to reach a use-after-free situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T01:01:06.000Z
CVE-2022-28349 
Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Valhall r19p0 through r23p0 before r24p0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T01:04:36.000Z
CVE-2022-28350 
Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-19T01:04:14.000Z
CVE-2022-28352 
WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:R
version: 3.1
Published: 2022-04-02T16:36:02.000Z
CVE-2022-28353 
In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-28354 
In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-24T00:00:00.000Z
CVE-2022-28355 
randomUUID in Scala.js before 1.10.0 generates predictable values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-02T20:22:16.000Z
CVE-2022-28356 
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-02T20:36:34.000Z
CVE-2022-28357 
NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-19T00:00:00.000Z
CVE-2022-28363 
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-09T16:26:45.000Z
CVE-2022-28364 
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Authentication is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-09T16:27:44.000Z
CVE-2022-28365 
Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture, and file/directory details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-09T00:00:00.000Z
CVE-2022-28366 
Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24839.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T22:41:53.000Z
CVE-2022-28367 
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T22:42:14.000Z
CVE-2022-28368 
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T00:00:00.000Z
CVE-2022-28369 
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The data (found at that URL) is written to /usr/sbin/dropbear and then executed as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:29:24.000Z
CVE-2022-28370 
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:29:14.000Z
CVE-2022-28371 
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:29:06.000Z
CVE-2022-28372 
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file upload to the device. This occurs in /lib/lua/luci/crtc.lua (IDU) and /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh (ODU).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:28:59.000Z
CVE-2022-28373 
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inject shell metacharacters to achieve remote code execution as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:28:51.000Z
CVE-2022-28374 
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. An authenticated remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/admin/settings.lua to achieve remote code execution as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:28:40.000Z
CVE-2022-28375 
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achieve remote code execution as root,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:28:33.000Z
CVE-2022-28376 
Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T03:27:43.000Z
CVE-2022-28377 
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-14T12:28:09.000Z
CVE-2022-28378 
Craft CMS before 3.7.29 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T17:28:54.000Z
CVE-2022-28379 
jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:R
version: 3.1
Published: 2022-04-03T17:42:12.000Z
CVE-2022-28380 
The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T17:55:06.000Z
CVE-2022-28381 
Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T18:30:20.000Z
CVE-2022-28382 
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an attacker may be able to extract information even from encrypted data, for example by observing repeating byte patterns. The firmware of the USB-to-SATA bridge controller INIC-3637EN uses AES-256 with the ECB mode. This operation mode of block ciphers (e.g., AES) always encrypts identical plaintext data, in this case blocks of 16 bytes, to identical ciphertext data. For some data, for instance bitmap images, the lack of the cryptographic property called diffusion, within ECB, can leak sensitive information even in encrypted data. Thus, the use of the ECB operation mode can put the confidentiality of specific information at risk, even in an encrypted form. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T00:00:00.000Z
CVE-2022-28383 
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code for the USB-to-SATA bridge controller on the USB drive (e.g., by leveraging physical access during the supply chain). This code is then executed. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428, Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0, Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1, and Fingerprint Secure Portable Hard Drive Part Number #53650.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T00:00:00.000Z
CVE-2022-28384 
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the correct passcode, and thus gaining unauthorized access to the stored encrypted data. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T00:00:00.000Z
CVE-2022-28385 
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated CD-ROM drive (containing the Windows and macOS client software). The content of this emulated CD-ROM drive is stored as an ISO-9660 image in the hidden sectors of the USB drive, that can only be accessed using special IOCTL commands, or when installing the drive in an external disk enclosure. By manipulating this ISO-9660 image or replacing it with another one, an attacker is able to store malicious software on the emulated CD-ROM drive. This software may get executed by an unsuspecting victim when using the device. For example, an attacker with temporary physical access during the supply chain could program a modified ISO-9660 image on a device that always accepts an attacker-controlled password for unlocking the device. If the attacker later on gains access to the used USB drive, he can simply decrypt all contained user data. Storing arbitrary other malicious software is also possible. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T15:39:26.000Z
CVE-2022-28386 
An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 failed unlock attempts) does not work as specified. More than 20 attempts may be made. This affects Keypad Secure USB 3.2 Gen 1 Drive Part Number #49428 and Store 'n' Go Secure Portable HDD GD25LK01-3637-C VER4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T00:00:00.000Z
CVE-2022-28387 
An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unauthorized access to the stored data. The attacker can simply use an undocumented IOCTL command that retrieves the correct password. This affects Executive Fingerprint Secure SSD GDMSFE01-INI3637-C VER1.1 and Fingerprint Secure Portable Hard Drive Part Number #53650.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-08T15:29:51.000Z
CVE-2022-28388 
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T20:07:39.000Z
CVE-2022-28389 
mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T20:07:30.000Z
CVE-2022-28390 
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T20:07:21.000Z
CVE-2022-28391 
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-03T20:20:12.000Z
CVE-2022-28394 
EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries (CWE-427). Please note that this was reported on an EOL version of the product, and users are advised to upgrade to the latest supported version (5.x).
Problem types: description: Uncontrolled Search Path Element
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager
Published: 2022-05-26T23:25:27.000Z
CVE-2022-28397 
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file. NOTE: Vendor states as detailed in Ghost's security documentation, files can only be uploaded and published by trusted users, this is intentional
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-12T16:29:06.000Z
CVE-2022-28410 
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=delete_agent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:15.000Z
CVE-2022-28411 
Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/admin/?page=agents/manage_agent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:14.000Z
CVE-2022-28412 
Car Driving School Managment System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:13.000Z
CVE-2022-28413 
Car Driving School Management System v1.0 was discovered to contain a SQL injection vulnerability via /cdsms/classes/Master.php?f=delete_enrollment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:12.000Z
CVE-2022-28414 
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:12.000Z
CVE-2022-28415 
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:11.000Z
CVE-2022-28416 
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:11.000Z
CVE-2022-28417 
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:10.000Z
CVE-2022-28420 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via BabyCare/admin.php?id=theme&setid=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:06.000Z
CVE-2022-28421 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin.php?id=posts&action=display&value=1&postid=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:05.000Z
CVE-2022-28422 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:04.000Z
CVE-2022-28423 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:04.000Z
CVE-2022-28424 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&find=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:03.000Z
CVE-2022-28425 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=display&value=1&roleid=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:02.000Z
CVE-2022-28426 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/pagerole.php&action=edit&roleid=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:07.000Z
CVE-2022-28427 
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/inbox.php&action=read&msgid=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T19:05:01.000Z