# CVEs published 2022-04-10

39 CVEs were published on April 10, 2022: 1 critical, 2 high. Days are UTC.

- [CVE-2022-27961](https://cve.now/CVE-2022-27961.md): A cross-site scripting (XSS) vulnerability at /ofcms/company-c-47 in OFCMS v1.1.4 allows attackers to execute arbitrary web scripts or HTML (no CVSS)
- [CVE-2022-27477](https://cve.now/CVE-2022-27477.md): Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. (no CVSS)
- [CVE-2022-27960](https://cve.now/CVE-2022-27960.md): Insecure permissions configured in the user\_id parameter at SysUserController.java of OFCMS v1.1.4 allows attackers to access and arbitraril (no CVSS)
- [CVE-2022-27958](https://cve.now/CVE-2022-27958.md): Insecure permissions configured in the userid parameter at /user/getuserprofile of FEBS-Security v1.0 allows attackers to access and arbitra (no CVSS)
- [CVE-2022-27476](https://cve.now/CVE-2022-27476.md): A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or (no CVSS)
- [CVE-2022-27125](https://cve.now/CVE-2022-27125.md): zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php. (no CVSS)
- [CVE-2022-27126](https://cve.now/CVE-2022-27126.md): zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php. (no CVSS)
- [CVE-2022-27127](https://cve.now/CVE-2022-27127.md): zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php. (no CVSS)
- [CVE-2022-27128](https://cve.now/CVE-2022-27128.md): An incorrect access control issue at /admin/run\_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts. (no CVSS)
- [CVE-2022-27129](https://cve.now/CVE-2022-27129.md): An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS)
- [CVE-2022-27131](https://cve.now/CVE-2022-27131.md): An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP f (no CVSS)
- [CVE-2022-27133](https://cve.now/CVE-2022-27133.md): zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php. (no CVSS)
- [CVE-2022-27268](https://cve.now/CVE-2022-27268.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27269](https://cve.now/CVE-2022-27269.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27270](https://cve.now/CVE-2022-27270.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27271](https://cve.now/CVE-2022-27271.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27272](https://cve.now/CVE-2022-27272.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27273](https://cve.now/CVE-2022-27273.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27274](https://cve.now/CVE-2022-27274.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27275](https://cve.now/CVE-2022-27275.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27276](https://cve.now/CVE-2022-27276.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a remote code execution (RCE) vulnerability (no CVSS)
- [CVE-2022-27277](https://cve.now/CVE-2022-27277.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file deletion vulnerability vi (no CVSS)
- [CVE-2022-27279](https://cve.now/CVE-2022-27279.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain an arbitrary file read via the function sub (no CVSS)
- [CVE-2022-27280](https://cve.now/CVE-2022-27280.md): InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting (XSS) vulnera (no CVSS)
- [CVE-2022-27286](https://cve.now/CVE-2022-27286.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanNonLogin. (no CVSS)
- [CVE-2022-27287](https://cve.now/CVE-2022-27287.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPPoE. (no CVSS)
- [CVE-2022-27288](https://cve.now/CVE-2022-27288.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanPPTP. (no CVSS)
- [CVE-2022-27289](https://cve.now/CVE-2022-27289.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanL2TP. (no CVSS)
- [CVE-2022-27290](https://cve.now/CVE-2022-27290.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formSetWanDhcpplus. (no CVSS)
- [CVE-2022-27291](https://cve.now/CVE-2022-27291.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. (no CVSS)
- [CVE-2022-27292](https://cve.now/CVE-2022-27292.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formLanguageChange. (no CVSS)
- [CVE-2022-27293](https://cve.now/CVE-2022-27293.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanSetup. (no CVSS)
- [CVE-2022-27294](https://cve.now/CVE-2022-27294.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formWlanWizardSetup. (no CVSS)
- [CVE-2022-27295](https://cve.now/CVE-2022-27295.md): D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formAdvanceSetup. (no CVSS)
- [CVE-2022-1291](https://cve.now/CVE-2022-1291.md): XSS vulnerability with default \`onCellHtmlData\` function in hhurz/tableexport.jquery.plugin (CVSS 7.6, hhurz/tableexport.jquery.plugin · tableexport.jquery.plugin)
- [CVE-2022-1290](https://cve.now/CVE-2022-1290.md): Stored XSS in "Name", "Group Name" & "Title" in polonel/trudesk (CVSS 9.0, polonel/trudesk)
- [CVE-2022-1289](https://cve.now/CVE-2022-1289.md): tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service (CVSS 4.3, tildearrow Furnace)
- [CVE-2022-1286](https://cve.now/CVE-2022-1286.md): heap-buffer-overflow in mrb\_vm\_exec in mruby/mruby in mruby/mruby (CVSS 5.9, mruby/mruby)
- [CVE-2022-1276](https://cve.now/CVE-2022-1276.md): Out-of-bounds Read in mrb\_get\_args in mruby/mruby (CVSS 8.4, mruby/mruby)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.