CVE-2022-30528

SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.

• CWE-89
• CWE-89

• https://github.com/asith-eranga/isicThird Party Advisory
• https://github.com/killmonday/isic.lk-RCEExploit, Third Party Advisory
• https://github.com/asith-eranga/isicThird Party Advisory
• https://github.com/killmonday/isic.lk-RCEExploit, Third Party Advisory

Published

Dec 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30522If Apache HTTP Server 2.4.53 is configured to do transformat…7.5
• CVE-2022-30523Trend Micro Password Manager (Consumer) version 5.0.0.1266 a…7.8
• CVE-2022-30524There is an invalid memory access in the TextLine class in T…7.8
• CVE-2022-30525A OS command injection vulnerability in the CGI program of Z…9.8
• CVE-2022-30526A privilege escalation vulnerability was identified in the C…7.8
• CVE-2022-30527A vulnerability has been identified in SINEC NMS (All versio…7.8
• CVE-2022-30529File upload vulnerability in asith-eranga ISIC tour booking …7.2
• CVE-2022-3053Inappropriate implementation in Pointer Lock in Google Chrom…4.3
• CVE-2022-30530Protection mechanism failure in the Intel(R) DSA software be…7.8
• CVE-2022-30531Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers fo…5.5
• CVE-2022-30532In affected versions of Octopus Deploy, there is no logging …5.3
• CVE-2022-30533Cross-site scripting vulnerability in Modern Events Calendar…5.4