CVE-2022-36249

Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code. Thus, leading to bypass of 2FA on API level.

• CWE-288
• CWE-306

• https://www.shopbeat.co.zaProduct
• https://www.shopbeat.co.zaProduct

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-3624A vulnerability was found in Linux Kernel and classified as …3.3
• CVE-2022-36242Clinic's Patient Management System v1.0 is vulnerable to SQL…9.8
• CVE-2022-36243Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 …5.3
• CVE-2022-36244Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 …5.4
• CVE-2022-36246Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 …9.8
• CVE-2022-36247Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 …9.1
• CVE-2022-3625A vulnerability was found in Linux Kernel. It has been class…7.8
• CVE-2022-36250Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 …8.8
• CVE-2022-36251Clinic's Patient Management System v1.0 is vulnerable to Cro…6.1
• CVE-2022-36254Multiple persistent cross-site scripting (XSS) vulnerabiliti…5.4
• CVE-2022-36255A SQL injection vulnerability in SupplierDAO.java in sazanrj…7.5
• CVE-2022-36256A SQL injection vulnerability in Stocks.java in sazanrjb Inv…7.5