Skip to main content

Aerocms CVE-2022-46061

MEDIUM
Improper Restriction of Rendered UI Layers or Frames (CWE-1021)
2022-12-13 cve@mitre.org
XSS Aerocms
6.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 13, 2022 - 14:15 nvd
MEDIUM 6.1

DescriptionNVD

AeroCMS v0.0.1 is vulnerable to ClickJacking.

AnalysisAI

AeroCMS v0.0.1 is vulnerable to ClickJacking. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1021. Affected products include: Aerocms Project Aerocms.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Aerocms

View all
CVE-2022-50895 CRITICAL POC
9.8 Jan 13

Aero CMS 0.0.1 has SQL injection in the author parameter exploitable through boolean-based, error-based, time-based, and
CVE-2022-38305 HIGH POC
8.8 Sep 13

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. Ra
CVE-2022-46137 HIGH POC
7.5 Dec 16

AeroCMS v0.0.1 is vulnerable to Directory Traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
CVE-2022-45329 HIGH POC
7.5 Nov 29

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter. Rated high severity (CV
CVE-2022-45331 HIGH POC
7.5 Nov 22

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. Rated high s
CVE-2022-45330 HIGH POC
7.5 Nov 22

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. Rate
CVE-2022-46135 HIGH POC
7.2 Dec 16

In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which

CVE-2022-46051 HIGH POC
7.2 Dec 13

The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks. Rated high severity (CV
CVE-2022-27061 HIGH POC
7.2 Apr 08

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Ad
CVE-2022-46059 MEDIUM POC
6.5 Dec 13

AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability

CVE-2022-38812 MEDIUM POC
6.5 Aug 31

AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter. Rated medium severity (CVSS 6.5), this vulnerabil
CVE-2022-27063 MEDIUM POC
6.1 Apr 08

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. Ra

Same weakness CWE-1021 – Improper Restriction of Rendered UI Layers or Frames

View all
CVE-2022-3167 HIGH POC
8.8
CVE-2021-3734 HIGH POC
8.8
CVE-2019-16371 HIGH POC
8.2
CVE-2024-33377 HIGH POC
8.1
CVE-2020-13119 HIGH POC
8.1
CVE-2022-1803 MEDIUM POC
6.9
CVE-2024-2177 MEDIUM POC
6.8
CVE-2024-4950 MEDIUM POC
6.5

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2022-46061 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy