CVE-2022-26348

Command Centre Server is vulnerable to SQL Injection via Windows Registry settings for date fields on the server. The Windows Registry setting allows an attacker using the Visitor Management Kiosk, an application designed for public use, to invoke an arbitrary SQL query that has been preloaded into the registry of the Windows Server to obtain sensitive information. This issue affects: Gallagher Command Centre 8.60 versions prior to 8.60.1652; 8.50 versions prior to 8.50.2245; 8.40 versions prior to 8.40.2216; 8.30 versions prior to 8.30.1470; version 8.20 and prior versions.

• CWE-89
• CWE-89

• https://security.gallagher.com/Security-Advisories/CVE-2022-26348Vendor Advisory
• https://security.gallagher.com/Security-Advisories/CVE-2022-26348Vendor Advisory

Published

Jul 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26342A buffer overflow vulnerability exists in the confsrv ucloud…9.8
• CVE-2022-26343Improper access control in the BIOS firmware for some Intel(…6.7
• CVE-2022-26344Incorrect default permissions in the installation binaries f…7.8
• CVE-2022-26345Uncontrolled search path element in the Intel(R) oneAPI Tool…7.3
• CVE-2022-26346A denial of service vulnerability exists in the ucloud_del_n…9.8
• CVE-2022-26347Rejected reason: This candidate was in a CNA pool that was n…
• CVE-2022-26349Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-2635The Autoptimize WordPress plugin before 3.1.1 does not sanit…4.8
• CVE-2022-26351Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-26352An issue was discovered in the ContentResource API in dotCMS…9.8
• CVE-2022-26353A flaw was found in the virtio-net device of QEMU. This flaw…7.5
• CVE-2022-26354A flaw was found in the vhost-vsock device of QEMU. In case …3.2