{"vulnerability": "cve-2022-4335", "sightings": [{"uuid": "2a9ce1c7-e984-4c40-931a-89923176202a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43350", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14940", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43350\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquiry.\n\ud83d\udccf Published: 2022-11-07T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-05T18:10:54.434Z\n\ud83d\udd17 References:\n1. https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md", "creation_timestamp": "2025-05-05T18:19:24.000000Z"}, {"uuid": "906d0aa4-38c4-46ef-b8e0-9d08b61ac358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43355", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14607", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43355\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_service.\n\ud83d\udccf Published: 2022-11-01T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-02T21:01:47.650Z\n\ud83d\udd17 References:\n1. https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-3.md", "creation_timestamp": "2025-05-02T21:16:29.000000Z"}, {"uuid": "57355798-477e-4f06-9ae5-14c0bd1587fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43354", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14606", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43354\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/manage_request.\n\ud83d\udccf Published: 2022-11-01T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-02T21:03:00.913Z\n\ud83d\udd17 References:\n1. https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-2.md", "creation_timestamp": "2025-05-02T21:16:28.000000Z"}, {"uuid": "d46e6987-bda5-4366-b354-da1321025285", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43353", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14605", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43353\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.\n\ud83d\udccf Published: 2022-11-01T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-02T21:05:06.480Z\n\ud83d\udd17 References:\n1. https://github.com/daytime888/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/SQLi-1.md", "creation_timestamp": "2025-05-02T21:16:27.000000Z"}, {"uuid": "21da91a1-c0fe-479f-930c-a7ebd3695022", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43351", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/14939", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-43351\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img.\n\ud83d\udccf Published: 2022-11-07T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-05T18:12:14.310Z\n\ud83d\udd17 References:\n1. https://github.com/Hujozay/bug_report/blob/main/vendors/oretnom23/sanitization-management-system/delete-file-1.md", "creation_timestamp": "2025-05-05T18:19:22.000000Z"}, {"uuid": "b051af2a-f109-48e3-b62b-bca15403e75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43357", "type": "seen", "source": "https://t.me/cibsecurity/69009", "content": "\u203c CVE-2022-43357 \u203c\n\nStack overflow vulnerability in ast_selectors.cpp in function Sass::CompoundSelector::has_real_parent_ref in libsass:3.6.5-8-g210218, which can be exploited by attackers to causea denial of service (DoS). Also affects the command line driver for libsass, sassc 3.6.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-22T22:25:11.000000Z"}, {"uuid": "3c89e92f-1735-4966-a58e-5ae3611013b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43358", "type": "seen", "source": "https://t.me/cibsecurity/68973", "content": "\u203c CVE-2022-43358 \u203c\n\nStack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-08-22T22:18:20.000000Z"}, {"uuid": "f317c0f3-5627-4c28-9038-611d65c4035b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4335", "type": "seen", "source": "https://t.me/cibsecurity/57057", "content": "\u203c CVE-2022-4335 \u203c\n\nA blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-01-27T20:39:40.000000Z"}, {"uuid": "3dbaf5b4-8509-42fe-8397-e41c75afa62e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43350", "type": "seen", "source": "https://t.me/cibsecurity/52609", "content": "\u203c CVE-2022-43350 \u203c\n\nSanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquiry.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-07T18:34:36.000000Z"}, {"uuid": "98639868-f619-4797-b842-c23523f6f141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43355", "type": "seen", "source": "https://t.me/cibsecurity/52346", "content": "\u203c CVE-2022-43355 \u203c\n\nSanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_service.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-01T06:13:42.000000Z"}, {"uuid": "3543ba00-dbe0-4f01-a072-b6a6888440e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43352", "type": "seen", "source": "https://t.me/cibsecurity/52595", "content": "\u203c CVE-2022-43352 \u203c\n\nSanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_quote.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-07T18:34:22.000000Z"}, {"uuid": "c295391a-5993-425b-94aa-5edf248581f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43351", "type": "seen", "source": "https://t.me/cibsecurity/52605", "content": "\u203c CVE-2022-43351 \u203c\n\nSanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-07T18:34:32.000000Z"}, {"uuid": "3eef07cb-98c8-48fd-8372-644dcf3b8f21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43353", "type": "seen", "source": "https://t.me/cibsecurity/52340", "content": "\u203c CVE-2022-43353 \u203c\n\nSanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/view_order.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-01T06:13:30.000000Z"}, {"uuid": "cac3951c-4a5a-4930-8c5f-78ba5ce3bfaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-43354", "type": "seen", "source": "https://t.me/cibsecurity/52336", "content": "\u203c CVE-2022-43354 \u203c\n\nSanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=orders/manage_request.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-01T06:13:26.000000Z"}, {"uuid": "0408f5a7-8b5f-494a-bee7-292589b17b31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4335", "type": "seen", "source": "https://t.me/poxek/6361", "content": "\u0421\u043e\u0431\u0440\u0430\u043b GitLab \u0432\u0438\u0434\u0435\u043e PoC's  \ud83d\udd0d\n\n\u041f\u0440\u0438 \u0440\u0435\u0441\u0435\u0440\u0447\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 CVE \u043f\u043e\u0434 GitLab \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043d\u0430\u0433\u043b\u044f\u0434\u043d\u043e\u0439 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 PoC \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0437 \u043d\u0438\u0445. \u0417\u0430\u043b\u0438\u043b \u0442\u0430\u043a\u0438\u0435 \u043a\u0435\u0439\u0441\u044b \u043a \u0441\u0435\u0431\u0435 \u043d\u0430 YouTube, \u0432\u0434\u0440\u0443\u0433 \u043a\u043e\u043c\u0443-\u0442\u043e \u0442\u043e\u0436\u0435 \u043f\u0440\u0438\u0433\u043e\u0434\u0438\u0442\u0441\u044f. \n\n\u0418\u0418\u0448\u043a\u0438 \u043f\u043e\u0438\u0441\u043a\u043e\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u043a\u0441\u0442\u0430\u0442\u0438, \u0432\u043e\u043e\u0431\u0449\u0435 \u0433\u043e\u0432\u043e\u0440\u044f\u0442, \u0447\u0442\u043e \u043d\u0430 \u044d\u0442\u0438 CVE \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e proof of concept. \u042d\u043a\u0441\u043a\u043b\u044e\u0437\u0438\u0432, \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f)\n\nRCE / command injection\n\u27a1\ufe0f CVE-2022-0751 - \u041d\u0435\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f, \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u0430\u044f \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Gitlab.com, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0436\u0435\u0440\u0442\u0432\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b.\n\u27a1\ufe0f CVE-2023-1708 - \u041a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u0431\u0443\u0444\u0435\u0440 \u043e\u0431\u043c\u0435\u043d\u0430 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u043c\u0430\u043d\u0434\n\u27a1\ufe0f CVE-2024-8402 - Maintainer \u043c\u043e\u0436\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0448\u0435\u043b\u043b-\u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e Google integration, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u0441\u044f \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0436\u0435\u0440\u0442\u0432\u044b \u043f\u0440\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438.\n\u27a1\ufe0f CVE-2024-9773 - shell injection \u0447\u0435\u0440\u0435\u0437 Harbor project name / helper scripts\n\u27a1\ufe0f CVE-2024-8640 - Reverse shell with root access to analytics Cube instance\n\nSSRF\n\u27a1\ufe0f CVE-2024-9870 - Full SSRF \u0447\u0435\u0440\u0435\u0437 Workspaces\n\u27a1\ufe0f CVE-2022-4335 - Blind SSRF \u043d\u0430 repository mirroring (DNS rebinding)\n\u27a1\ufe0f CVE-2021-22179 - SSRF \u0432 webhook / outbound requests\n\u27a1\ufe0fCVE-2025-6454 - CRLF Injection in Webhook custom header could lead to blind SSRF\n\u27a1\ufe0fCVE-2024-8977 - Full read SSRF\n\nXSS\n\u27a1\ufe0f CVE-2024-8312 - Stored XSS with CSP bypass\n\u27a1\ufe0f CVE-2025-7734 - Stored XSS in blob viewer\n\nDoS\n\u27a1\ufe0f CVE-2026-1456 - DoS \u0447\u0435\u0440\u0435\u0437 tasks / GraphQL-ish \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443\n\u27a1\ufe0f CVE-2026-1458 - DoS + path traversal \u0432 \u0442\u043e\u043c \u0436\u0435 \u0434\u0443\u0445\u0435\n\u27a1\ufe0f CVE-2024-8177 - Harbor DoS\n\u27a1\ufe0f CVE-2024-12379 - \u0441\u0435\u0440\u0438\u044f screen recordings \u043f\u043e\u0434 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u043e\u0439\n\n\u041f\u0440\u043e\u0447\u0435\u0435\n\u27a1\ufe0f CVE-2026-1230 - \u041d\u0435\u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043e\u0442\u043e\u0431\u0440\u0430\u0436\u0430\u0435\u043c\u044b\u043c\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438\n\u27a1\ufe0f CVE-2024-6502 - \u0412\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 GitLab \u043d\u0435 \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u0435\u0442 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0438\u0437 \u0440\u0435\u043b\u0438\u0437\u043e\u0432.\n\u27a1\ufe0f CVE-2024-8970 - Account takeover\n\u27a1\ufe0f CVE-2021-22203 - Arbitrary file read\n\n\ud83d\udcab @pentestnotes", "creation_timestamp": "2026-10-07T09:16:13.000000Z"}]}