CVE-2022-27247

onlinetolls in cdSoft Onlinetools-Smart Winhotel.MX 2021 allows an attacker to download sensitive information about any customer (e.g., data of birth, full address, mail information, and phone number) via GastKont Insecure Direct Object Reference.

• CWE-639

• https://myses.de/#aboutThird Party Advisory
• https://myses.de/pdf/CVE2022-27247.pdfExploit, Third Party Advisory
• https://myses.de/#aboutThird Party Advisory
• https://myses.de/pdf/CVE2022-27247.pdfExploit, Third Party Advisory

Published

May 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-27241A vulnerability has been identified in Mendix Applications u…7.5
• CVE-2022-27242A vulnerability has been identified in OpenV2G (V0.9.4). The…5.5
• CVE-2022-27243An issue was discovered in MISP before 2.4.156. app/View/Use…7.8
• CVE-2022-27244An issue was discovered in MISP before 2.4.156. A malicious …4.8
• CVE-2022-27245An issue was discovered in MISP before 2.4.156. app/Model/Se…8.8
• CVE-2022-27246An issue was discovered in MISP before 2.4.156. An SVG org l…6.1
• CVE-2022-27248A directory traversal vulnerability in IdeaRE RefTree before…6.5
• CVE-2022-27249An unrestricted file upload vulnerability in IdeaRE RefTree …8.8
• CVE-2022-2725A vulnerability was found in SourceCodester Company Website …6.1
• CVE-2022-27250The UNISOC chipset through 2022-03-15 allows attackers to ob…9.8
• CVE-2022-27254The remote keyless system on Honda Civic 2018 vehicles sends…5.3
• CVE-2022-27255In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG f…9.8