CVE-2022-31798

Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.

• CWE-384

• http://packetstormsecurity.com/files/167992/Nortek-Linear-eMerge-E3-Series-Account-Takeover.htmlThird Party Advisory, VDB Entry
• https://eg.linkedin.com/in/omar-1-hashemNot Applicable
• https://gist.github.com/omarhashem123/bccdcec70ab7e8f00519d56ea2e3fd79Third Party Advisory
• http://packetstormsecurity.com/files/167992/Nortek-Linear-eMerge-E3-Series-Account-Takeover.htmlThird Party Advisory, VDB Entry
• https://eg.linkedin.com/in/omar-1-hashemNot Applicable
• https://gist.github.com/omarhashem123/bccdcec70ab7e8f00519d56ea2e3fd79Third Party Advisory

Published

Aug 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31791WatchGuard Firebox and XTM appliances allow a local attacker…7.8
• CVE-2022-31792A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2022-31793do_request in request.c in muhttpd before 1.1.7 allows remot…7.5
• CVE-2022-31794An issue was discovered on Fujitsu ETERNUS CentricStor CS800…9.8
• CVE-2022-31795An issue was discovered on Fujitsu ETERNUS CentricStor CS800…9.8
• CVE-2022-31796libjpeg 1.63 has a heap-based buffer over-read in Hierarchic…6.5
• CVE-2022-31799Bottle before 0.12.20 mishandles errors during early request…9.8
• CVE-2022-3180The WPGateway Plugin for WordPress is vulnerable to privileg…9.8
• CVE-2022-31800An unauthenticated, remote attacker could upload malicious l…9.8
• CVE-2022-31801An unauthenticated, remote attacker could upload malicious l…9.8
• CVE-2022-31802In CODESYS Gateway Server V2 for versions prior to V2.3.9.38…9.8
• CVE-2022-31803In CODESYS Gateway Server V2 an insufficient check for the a…5.3