https://vulnerability.circl.lu/sightings/feed 2026-06-11T04:54:57.963540+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/7d997aa1-1f9c-4d00-aaa5-cbe861516421/export 2026-06-11T04:54:58.326242+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7d997aa1-1f9c-4d00-aaa5-cbe861516421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37161", "type": "seen", "source": "https://t.me/cibsecurity/48783", "content": "\u203c CVE-2022-37161 \u203c\n\nClaroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-25T20:23:52.000000Z"} 2022-08-25T20:23:52+00:00 https://vulnerability.circl.lu/sighting/4d1fa493-1e60-4569-8e2a-b72cf011d5f7/export 2026-06-11T04:54:58.326147+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "4d1fa493-1e60-4569-8e2a-b72cf011d5f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37160", "type": "seen", "source": "https://t.me/cibsecurity/48786", "content": "\u203c CVE-2022-37160 \u203c\n\nClaroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-25T20:23:55.000000Z"} 2022-08-25T20:23:55+00:00 https://vulnerability.circl.lu/sighting/10453015-8aa3-4277-9ec1-3880448e33ec/export 2026-06-11T04:54:58.326068+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "10453015-8aa3-4277-9ec1-3880448e33ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37162", "type": "seen", "source": "https://t.me/cibsecurity/48787", "content": "\u203c CVE-2022-37162 \u203c\n\nClaroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-25T20:23:56.000000Z"} 2022-08-25T20:23:56+00:00 https://vulnerability.circl.lu/sighting/72608a30-48ec-4e14-aa82-6ccd4042fceb/export 2026-06-11T04:54:58.325978+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "72608a30-48ec-4e14-aa82-6ccd4042fceb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37164", "type": "seen", "source": "https://t.me/cibsecurity/49465", "content": "\u203c CVE-2022-37164 \u203c\n\nInoda OnTrack v3.4 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-08T20:15:21.000000Z"} 2022-09-08T20:15:21+00:00 https://vulnerability.circl.lu/sighting/dabfd7ff-7021-49f8-a8f8-5445e652aba0/export 2026-06-11T04:54:58.325861+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dabfd7ff-7021-49f8-a8f8-5445e652aba0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-37163", "type": "seen", "source": "https://t.me/cibsecurity/49473", "content": "\u203c CVE-2022-37163 \u203c\n\nBminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-08T20:15:29.000000Z"} 2022-09-08T20:15:29+00:00 https://vulnerability.circl.lu/sighting/256fe22c-768f-4748-92fd-8b49938f7bba/export 2026-06-11T04:54:58.323282+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "256fe22c-768f-4748-92fd-8b49938f7bba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3716", "type": "seen", "source": "https://t.me/cibsecurity/52137", "content": "\u203c CVE-2022-3716 \u203c\n\nA vulnerability classified as problematic was found in SourceCodester Online Medicine Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /omos/admin/?page=user/list. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-212347.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-10-27T14:28:18.000000Z"} 2022-10-27T14:28:18+00:00