# CVEs published 2022-04-26

36 CVEs were published on April 26, 2022: 3 critical, 5 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-27888](https://cve.now/CVE-2022-27888.md): The Foundry Issues service was found to be logging in a manner that captured session tokens. (CVSS 5.5, Palantir Foundry Issues)
- [CVE-2022-26564](https://cve.now/CVE-2022-26564.md): HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprez (no CVSS)
- [CVE-2022-28918](https://cve.now/CVE-2022-28918.md): GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plug (no CVSS)
- [CVE-2022-28527](https://cve.now/CVE-2022-28527.md): dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del. (no CVSS)
- [CVE-2022-28528](https://cve.now/CVE-2022-28528.md): bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edi (no CVSS)
- [CVE-2022-28524](https://cve.now/CVE-2022-28524.md): ED01-CMS v20180505 was discovered to contain a SQL injection vulnerability via the component post.php. (no CVSS)
- [CVE-2022-28525](https://cve.now/CVE-2022-28525.md): ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit\_user&id=1. (no CVSS)
- [CVE-2022-28522](https://cve.now/CVE-2022-28522.md): ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add. (no CVSS)
- [CVE-2022-28523](https://cve.now/CVE-2022-28523.md): HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. (no CVSS)
- [CVE-2022-28521](https://cve.now/CVE-2022-28521.md): ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp\_set\_config. (no CVSS)
- [CVE-2022-28058](https://cve.now/CVE-2022-28058.md): Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \\backend\\file\_controller.php. (no CVSS)
- [CVE-2022-28059](https://cve.now/CVE-2022-28059.md): Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \\backend\\database\_controller.php. (no CVSS)
- [CVE-2022-28450](https://cve.now/CVE-2022-28450.md): nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a re (no CVSS)
- [CVE-2022-28449](https://cve.now/CVE-2022-28449.md): nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-28448](https://cve.now/CVE-2022-28448.md): nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2022-24866](https://cve.now/CVE-2022-24866.md): Exposure of Sensitive Information to an Unauthorized Actor in Discourse Assign (CVSS 4.3, discourse-assign)
- [CVE-2022-27854](https://cve.now/CVE-2022-27854.md): WordPress Psychological tests & quizzes plugin \<= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Alexander Ustimenko Psychological tests & quizzes)
- [CVE-2022-1466](https://cve.now/CVE-2022-1466.md): Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. (no CVSS, rhsso · org.keycloak:keycloak-core)
- [CVE-2021-26628](https://cve.now/CVE-2021-26628.md): MaxBoard XSS and File Upload Vulnerability (CVSS 8.1, No Vendor Information MaxBoard)
- [CVE-2021-26629](https://cve.now/CVE-2021-26629.md): tobesoft XPLATFORM Path Traversal Vulnerability (CVSS 8.8, tobesoft Co. XPLATFORM)
- [CVE-2021-36895](https://cve.now/CVE-2021-36895.md): WordPress Tripetto plugin \<= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload (CVSS 4.7, Tripetto)
- [CVE-2021-36867](https://cve.now/CVE-2021-36867.md): WordPress Psychological tests & quizzes plugin \<= 0.21.19 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4, Alexander Ustimenko Psychological tests & quizzes)
- [CVE-2022-28218](https://cve.now/CVE-2022-28218.md): An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. (no CVSS)
- [CVE-2022-1173](https://cve.now/CVE-2022-1173.md): stored xss in getgrav/grav (CVSS 8.2, getgrav/grav)
- [CVE-2022-24881](https://cve.now/CVE-2022-24881.md): Command Injection in Ballcat Codegen (CVSS 8.8, ballcat-projects ballcat-codegen · com.hccake:ballcat-codeg…)
- [CVE-2022-23942](https://cve.now/CVE-2022-23942.md): Apache Doris hardcoded cryptography initialization (no CVSS, Apache Software Foundation Apache Doris · pydoris)
- [CVE-2022-27985](https://cve.now/CVE-2022-27985.md): CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php. (no CVSS)
- [CVE-2022-27984](https://cve.now/CVE-2022-27984.md): CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via the menu\_filter parameter at /administrator/templates/default/html (no CVSS)
- [CVE-2022-27469](https://cve.now/CVE-2022-27469.md): Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF). (no CVSS)
- [CVE-2022-27468](https://cve.now/CVE-2022-27468.md): Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file upl (no CVSS)
- [CVE-2022-27299](https://cve.now/CVE-2022-27299.md): Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the component room.php. (no CVSS)
- [CVE-2022-29806](https://cve.now/CVE-2022-29806.md): ZoneMinder before 1.36.13 allows remote code execution via an invalid language. (no CVSS)
- [CVE-2022-29499](https://cve.now/CVE-2022-29499.md): The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. (CVSS 9.8, KEV)
- [CVE-2022-24706](https://cve.now/CVE-2022-24706.md): Remote Code Execution Vulnerability in Packaging (CVSS 9.8, KEV, Apache Software Foundation Apache CouchDB)
- [CVE-2022-24882](https://cve.now/CVE-2022-24882.md): Server side NTLM does not properly check parameters in FreeRDP (CVSS 9.1, FreeRDP)
- [CVE-2022-24883](https://cve.now/CVE-2022-24883.md): FreeRDP Server authentication might allow invalid credentials to pass (CVSS 7.4, FreeRDP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.