CVE-2022-37346

EC-CUBE plugin 'Product Image Bulk Upload Plugin' 1.0.0 and 4.1.0 contains an insufficient verification vulnerability when uploading files. Exploiting this vulnerability allows a remote unauthenticated attacker to upload arbitrary files other than image files. If a user with an administrative privilege of EC-CUBE where the vulnerable plugin is installed is led to upload a specially crafted file, an arbitrary script may be executed on the system.

• CWE-434
• CWE-434

• https://jvn.jp/en/jp/JVN30900552/index.htmlThird Party Advisory
• https://www.ec-cube.net/info/weakness/20220909/product_images_uploader.phpPatch, Vendor Advisory
• https://jvn.jp/en/jp/JVN30900552/index.htmlThird Party Advisory
• https://www.ec-cube.net/info/weakness/20220909/product_images_uploader.phpPatch, Vendor Advisory

Published

Sep 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-37340Uncontrolled search path in some Intel(R) QAT drivers for Wi…7.3
• CVE-2022-37341Improper access control in some Intel(R) Ethernet Adapters a…7.8
• CVE-2022-37342Authenticated (admin+) Stored Cross-Site Scripting (XSS) vul…4.8
• CVE-2022-37343Improper access control in the BIOS firmware for some Intel(…6.7
• CVE-2022-37344Missing Access Control vulnerability in PHP Crafts Accommoda…9.8
• CVE-2022-37345Improper authentication in BIOS firmware[A1] for some Intel(…7.8
• CVE-2022-37347Trend Micro Security 2021 and 2022 (Consumer) is vulnerable …5.5
• CVE-2022-37348Trend Micro Security 2021 and 2022 (Consumer) is vulnerable …5.5
• CVE-2022-37349This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-3735A vulnerability was found in seccome Ehoney. It has been rat…9.8
• CVE-2022-37350This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2022-37351This vulnerability allows remote attackers to disclose sensi…5.5