https://vulnogram.org/ Most recent CVEs assigned by Securifera, Inc. (securifera). https://vulnogram.org/seaview/icons/securifera.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-94367 https://vulnogram.org/CVE-2026-94367 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing co… High Tue, 22 Sep 2026 23:10:19 GMT https://vulnogram.org/CVE-2026-92930 https://vulnogram.org/CVE-2026-92930 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to th… Medium Tue, 22 Sep 2026 23:10:18 GMT https://vulnogram.org/CVE-2026-92929 https://vulnogram.org/CVE-2026-92929 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local… Medium Network Exploitable Tue, 22 Sep 2026 23:10:17 GMT https://vulnogram.org/CVE-2026-92928 https://vulnogram.org/CVE-2026-92928 OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenti… Medium Network Exploitable Tue, 22 Sep 2026 23:10:16 GMT https://vulnogram.org/CVE-2026-90817 https://vulnogram.org/CVE-2026-90817 An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controll… Critical Network Exploitable Sun, 20 Sep 2026 12:05:32 GMT https://vulnogram.org/CVE-2026-90823 https://vulnogram.org/CVE-2026-90823 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface ca… Critical Network Exploitable Thu, 17 Sep 2026 11:57:54 GMT https://vulnogram.org/CVE-2026-90822 https://vulnogram.org/CVE-2026-90822 FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface… Critical Network Exploitable Thu, 17 Sep 2026 11:57:44 GMT https://vulnogram.org/CVE-2022-48604 https://vulnogram.org/CVE-2022-48604 A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed agai… High Wed, 09 Aug 2023 18:35:32 GMT https://vulnogram.org/CVE-2022-48603 https://vulnogram.org/CVE-2022-48603 A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execut… High Wed, 09 Aug 2023 18:34:48 GMT https://vulnogram.org/CVE-2022-48602 https://vulnogram.org/CVE-2022-48602 A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execute… High Wed, 09 Aug 2023 18:33:39 GMT https://vulnogram.org/CVE-2022-48601 https://vulnogram.org/CVE-2022-48601 A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execute… High Wed, 09 Aug 2023 18:32:30 GMT https://vulnogram.org/CVE-2022-48600 https://vulnogram.org/CVE-2022-48600 A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against… High Wed, 09 Aug 2023 18:28:29 GMT https://vulnogram.org/CVE-2022-48599 https://vulnogram.org/CVE-2022-48599 A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execute… High Wed, 09 Aug 2023 18:26:24 GMT https://vulnogram.org/CVE-2022-48598 https://vulnogram.org/CVE-2022-48598 A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being ex… High Wed, 09 Aug 2023 18:25:02 GMT https://vulnogram.org/CVE-2022-48597 https://vulnogram.org/CVE-2022-48597 A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed… High Wed, 09 Aug 2023 18:23:45 GMT https://vulnogram.org/CVE-2022-48596 https://vulnogram.org/CVE-2022-48596 A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execut… High Wed, 09 Aug 2023 18:21:34 GMT https://vulnogram.org/CVE-2022-48595 https://vulnogram.org/CVE-2022-48595 A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being exe… High Wed, 09 Aug 2023 18:19:24 GMT https://vulnogram.org/CVE-2022-48594 https://vulnogram.org/CVE-2022-48594 A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execut… High Wed, 09 Aug 2023 18:18:03 GMT https://vulnogram.org/CVE-2022-48593 https://vulnogram.org/CVE-2022-48593 A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execut… High Wed, 09 Aug 2023 18:14:54 GMT https://vulnogram.org/CVE-2022-48592 https://vulnogram.org/CVE-2022-48592 A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arb… High Wed, 09 Aug 2023 18:09:37 GMT https://vulnogram.org/CVE-2022-48591 https://vulnogram.org/CVE-2022-48591 A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbit… High Wed, 09 Aug 2023 18:04:59 GMT https://vulnogram.org/CVE-2022-48590 https://vulnogram.org/CVE-2022-48590 A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being… High Wed, 09 Aug 2023 17:57:42 GMT https://vulnogram.org/CVE-2022-48589 https://vulnogram.org/CVE-2022-48589 A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being execute… High Wed, 09 Aug 2023 17:54:20 GMT https://vulnogram.org/CVE-2022-48588 https://vulnogram.org/CVE-2022-48588 A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being ex… High Wed, 09 Aug 2023 17:47:49 GMT https://vulnogram.org/CVE-2022-48587 https://vulnogram.org/CVE-2022-48587 A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed aga… High Wed, 09 Aug 2023 17:46:05 GMT https://vulnogram.org/CVE-2022-48586 https://vulnogram.org/CVE-2022-48586 A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against… High Wed, 09 Aug 2023 17:44:56 GMT https://vulnogram.org/CVE-2022-48585 https://vulnogram.org/CVE-2022-48585 A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed… High Wed, 09 Aug 2023 17:42:14 GMT https://vulnogram.org/CVE-2022-48584 https://vulnogram.org/CVE-2022-48584 A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to… High Wed, 09 Aug 2023 17:29:49 GMT https://vulnogram.org/CVE-2022-48583 https://vulnogram.org/CVE-2022-48583 A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the und… High Wed, 09 Aug 2023 17:13:54 GMT https://vulnogram.org/CVE-2022-48582 https://vulnogram.org/CVE-2022-48582 A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the… High Wed, 09 Aug 2023 17:11:15 GMT https://vulnogram.org/CVE-2022-48581 https://vulnogram.org/CVE-2022-48581 A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlyin… High Wed, 09 Aug 2023 17:08:11 GMT https://vulnogram.org/CVE-2022-48580 https://vulnogram.org/CVE-2022-48580 A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the un… High Wed, 09 Aug 2023 17:02:24 GMT