CVE-2022-25813

In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in the party component to activate the SSTI. A RCE is then possible.

• CWE-1336
• CWE-94

• http://www.openwall.com/lists/oss-security/2022/09/02/4Mailing List, Patch, Third Party Advisory
• https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2bMailing List, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/09/02/4Mailing List, Patch, Third Party Advisory
• https://lists.apache.org/thread/vmj5s0qb59t0lvzf3vol3z1sc3sgyb2bMailing List, Patch, Vendor Advisory

Published

Sep 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25807An issue was discovered in the IGEL Universal Management Sui…5.5
• CVE-2022-25809Improper Neutralization of audio output from 3rd and 4th Gen…9.8
• CVE-2022-2581Out-of-bounds Read in GitHub repository vim/vim prior to 9.0…7.8
• CVE-2022-25810The Transposh WordPress Translation WordPress plugin through…6.5
• CVE-2022-25811The Transposh WordPress Translation WordPress plugin through…7.2
• CVE-2022-25812The Transposh WordPress Translation WordPress plugin before …7.2
• CVE-2022-25814PendingIntent hijacking vulnerability in Wearable Manager In…7.8
• CVE-2022-25815PendingIntent hijacking vulnerability in Weather application…7.8
• CVE-2022-25816Improper authentication in Samsung Lock and mask apps settin…4.6
• CVE-2022-25817Improper authentication in One UI Home prior to SMR Mar-2022…3.3
• CVE-2022-25818Improper boundary check in UWB stack prior to SMR Mar-2022 R…9.8
• CVE-2022-25819OOB read vulnerability in hdcp2 device node prior to SMR Mar…5.5