CVE-2022-29287

MEDIUM Year: 2022
CVSS v3 Score
4.9
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-639
View all →

Vulnerability Description

Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator) to export the user options of any user, even ones with higher privileges (like Global Administrators) than the current user. The exported XML contains every option of the exported user (even the hashed password).

Related Vulnerabilities

CVE-2019-7925

MEDIUM
CVSS:4.9(Medium)

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with l...

CWE-6392019

CVE-2020-19890

MEDIUM
CVSS:4.9(Medium)

DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security, you can read any file's content.

CWE-6392020

CVE-2025-28874

MEDIUM
CVSS:4.9(Medium)

Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BP Email...

CWE-6392025

CVE-2025-31833

MEDIUM
CVSS:4.9(Medium)

Authorization Bypass Through User-Controlled Key vulnerability in themeglow JobBoard Job listing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBoard Jo...

CWE-6392025

CVE-2023-3290

MEDIUM
CVSS:5.0(Medium)

A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system. This results in unauthorized data manipulation.

CWE-6392023

CVE-2025-24969

MEDIUM
CVSS:5.0(Medium)

iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the picture ID in the URL. Version 3.2.1 contains a patch for the ...

CWE-6392025