CVE-2022-30628

It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL https://XXXX.supersmart.me/services/v4/invoiceImg?orderId=XXXXX

• https://www.gov.il/en/Departments/faq/cve_advisoriesThird Party Advisory
• https://www.gov.il/en/Departments/faq/cve_advisoriesThird Party Advisory

Published

Jul 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30622Disclosure of information - the system allows you to view us…7.3
• CVE-2022-30623The server checks the user's cookie in a non-standard way, a…9.8
• CVE-2022-30624Browsing the admin.html page allows the user to reset the ad…7.5
• CVE-2022-30625Directory listing is a web server function that displays the…5.3
• CVE-2022-30626Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show…7.5
• CVE-2022-30627This vulnerability affects all of the company's products tha…7.5
• CVE-2022-30629Non-random values for ticket_age_add in session tickets in c…3.1
• CVE-2022-3063Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2022-30630Uncontrolled recursion in Glob in io/fs before Go 1.17.12 an…7.5
• CVE-2022-30631Uncontrolled recursion in Reader.Read in compress/gzip befor…7.5
• CVE-2022-30632Uncontrolled recursion in Glob in path/filepath before Go 1.…7.5
• CVE-2022-30633Uncontrolled recursion in Unmarshal in encoding/xml before G…7.5