Skip to main content

Aerocms CVE-2022-50895

CRITICAL
SQL Injection (CWE-89)
2026-01-13 disclosure@vulncheck.com
SQLi Aerocms Aerocms Project
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
PoC Detected
Mar 02, 2026 - 15:16 vuln.today
Public exploit code
CVE Published
Jan 13, 2026 - 23:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boolean-based, error-based, time-based, and UNION query techniques to extract sensitive database information and potentially compromise the system.

AnalysisAI

Aero CMS 0.0.1 has SQL injection in the author parameter exploitable through boolean-based, error-based, time-based, and UNION query techniques. PoC available.

Technical ContextAI

The author parameter is concatenated into SQL queries (CWE-89).

RemediationAI

Use parameterized queries.

More in Aerocms

View all
CVE-2022-38305 HIGH POC
8.8 Sep 13

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. Ra
CVE-2022-46137 HIGH POC
7.5 Dec 16

AeroCMS v0.0.1 is vulnerable to Directory Traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
CVE-2022-45329 HIGH POC
7.5 Nov 29

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter. Rated high severity (CV
CVE-2022-45331 HIGH POC
7.5 Nov 22

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. Rated high s
CVE-2022-45330 HIGH POC
7.5 Nov 22

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. Rate
CVE-2022-46135 HIGH POC
7.2 Dec 16

In AeroCms v0.0.1, there is an arbitrary file upload vulnerability at /admin/posts.php?source=edit_post , through which

CVE-2022-46051 HIGH POC
7.2 Dec 13

The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks. Rated high severity (CV
CVE-2022-27061 HIGH POC
7.2 Apr 08

AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Ad
CVE-2022-46059 MEDIUM POC
6.5 Dec 13

AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability

CVE-2022-38812 MEDIUM POC
6.5 Aug 31

AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter. Rated medium severity (CVSS 6.5), this vulnerabil
CVE-2022-46061 MEDIUM POC
6.1 Dec 13

AeroCMS v0.0.1 is vulnerable to ClickJacking. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitab
CVE-2022-27063 MEDIUM POC
6.1 Apr 08

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. Ra

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2022-50895 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy