CVE-2022-23320

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.

• CWE-287

• https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29Third Party Advisory
• https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/Exploit, Third Party Advisory
• https://www.xmpie.com/ustore-release-notes/Release Notes, Vendor Advisory
• https://www.linkedin.com/feed/update/urn:li:activity:6894666176450887681?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6894666176450887681%2C6895051709354192896%29Third Party Advisory
• https://www.triaxiomsecurity.com/xmpie-ustore-vulnerabilities-discovered/Exploit, Third Party Advisory
• https://www.xmpie.com/ustore-release-notes/Release Notes, Vendor Advisory

Published

Feb 7, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23315MCMS v5.2.4 was discovered to contain an arbitrary file uplo…9.8
• CVE-2022-23316An issue was discovered in taoCMS v3.0.2. There is an arbitr…4.9
• CVE-2022-23317CobaltStrike <=4.5 HTTP(S) listener does not determine wheth…7.5
• CVE-2022-23318A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows a…7.1
• CVE-2022-23319A segmentation fault during PCF file parsing in pcf2bdf vers…5.5
• CVE-2022-2332A local unprivileged attacker may escalate to administrator …7.8
• CVE-2022-23321A persistent cross-site scripting (XSS) vulnerability exists…4.8
• CVE-2022-23327A design flaw in Go-Ethereum 1.10.12 and older versions allo…7.5
• CVE-2022-23328A design flaw in all versions of Go-Ethereum allows an attac…7.5
• CVE-2022-23329A vulnerability in ${"freemarker.template.utility.Execute"?n…9.8
• CVE-2022-2333If an attacker manages to trick a valid user into loading a …7.8
• CVE-2022-23330A remote code execution (RCE) vulnerability in HelloWorldAdd…8.8