# CVEs published 2022-12-24

14 CVEs were published on December 24, 2022: 1 critical, 1 high. Days are UTC.

- [CVE-2020-36626](https://cve.now/CVE-2020-36626.md): Modern Tribe Panel Builder Plugin SearchFilter.php add\_post\_content\_filtered\_to\_search\_sql sql injection (CVSS 5.5, Modern Tribe Panel Builder Plugin)
- [CVE-2022-46175](https://cve.now/CVE-2022-46175.md): JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. (CVSS 7.1, json5)
- [CVE-2022-4725](https://cve.now/CVE-2022-4725.md): AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery (CVSS 5.5, AWS SDK · com.amazonaws:aws-android-sdk-mobile-client)
- [CVE-2022-4726](https://cve.now/CVE-2022-4726.md): SourceCodester Sanitization Management System Admin Login sql injection (CVSS 6.3, SourceCodester Sanitization Management System)
- [CVE-2022-4727](https://cve.now/CVE-2022-4727.md): OpenMRS Appointment Scheduling Module Notes AppointmentRequest.java getNotes cross site scripting (CVSS 3.5, OpenMRS Appointment Scheduling Module)
- [CVE-2022-4728](https://cve.now/CVE-2022-4728.md): Graphite Web Cookie cross site scripting (CVSS 3.5, Graphite Web · graphite-web)
- [CVE-2022-4729](https://cve.now/CVE-2022-4729.md): Graphite Web Template Name cross site scripting (CVSS 3.5, Graphite Web · graphite-web)
- [CVE-2022-4730](https://cve.now/CVE-2022-4730.md): Graphite Web Absolute Time Range cross site scripting (CVSS 3.5, Graphite Web · graphite-web)
- [CVE-2022-4732](https://cve.now/CVE-2022-4732.md): Unrestricted Upload of File with Dangerous Type in microweber/microweber (CVSS 4.7, microweber/microweber)
- [CVE-2022-4733](https://cve.now/CVE-2022-4733.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 6.7, openemr/openemr)
- [CVE-2022-47932](https://cve.now/CVE-2022-47932.md): Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns (CVSS 6.5)
- [CVE-2022-47933](https://cve.now/CVE-2022-47933.md): Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. (CVSS 6.5)
- [CVE-2022-47934](https://cve.now/CVE-2022-47934.md): Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file tha (CVSS 6.5)
- [CVE-2022-47949](https://cve.now/CVE-2022-47949.md): The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execu (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.