CVE-2022-21666

Name: CVE-2022-21666
Creator: NVD / NIST
Published: 2022-01-10T20:15:08.247+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.2/10EPSS 1.19%

Last modified Jun 17, 2026

CVE-2022-21666 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection in usersearch.php only for users with administrative privileges. EPSS estimates a 1.19% chance of exploitation in the next 30 days.

Description

Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection in usersearch.php only for users with administrative privileges. Users should replace the file `admin/pages/useredit.php` with a newer version. USOC version Pb2.4Bfx3 contains a fixed version of `admin/pages/useredit.php`.

Metrics

CVSS 3.1

7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.19%

64.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Useful Simple Open-Source Cms Project	Useful Simple Open-Source Cms	< pb2.4bfx3

References

https://github.com/Aaron-Junker/USOC/commit/c331d26aaab41a7e9e8c1c1a990132dca9d01e10Patch, Third Party Advisory
https://github.com/Aaron-Junker/USOC/releases/tag/Pb2.4Bfx3Release Notes, Third Party Advisory
https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-557p-hhpc-4wrxThird Party Advisory
https://github.com/Aaron-Junker/USOC/commit/c331d26aaab41a7e9e8c1c1a990132dca9d01e10Patch, Third Party Advisory
https://github.com/Aaron-Junker/USOC/releases/tag/Pb2.4Bfx3Release Notes, Third Party Advisory
https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-557p-hhpc-4wrxThird Party Advisory

Timeline

Published: Jan 10, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-21666?

How severe is CVE-2022-21666?

CVE-2022-21666 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 1.19% probability of exploitation in the next 30 days.

How do I fix CVE-2022-21666?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-21666?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST