CVE-2022-38542

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.

• CWE-89

• https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/Third Party Advisory
• https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L149Third Party Advisory
• https://github.com/hhyo/Archery/issues/1841Third Party Advisory
• https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/Third Party Advisory
• https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L149Third Party Advisory
• https://github.com/hhyo/Archery/issues/1841Third Party Advisory

Published

Sep 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38537Archery v1.4.5 to v1.8.5 was discovered to contain multiple …9.8
• CVE-2022-38538Archery v1.7.0 to v1.8.5 was discovered to contain a SQL inj…9.8
• CVE-2022-38539Archery v1.7.5 to v1.8.5 was discovered to contain a SQL inj…9.8
• CVE-2022-3854A flaw was found in Ceph, relating to the URL processing on …6.5
• CVE-2022-38540Archery v1.4.0 to v1.8.5 was discovered to contain a SQL inj…9.8
• CVE-2022-38541Archery v1.8.3 to v1.8.5 was discovered to contain multiple …9.8
• CVE-2022-38545Valine v1.4.18 was discovered to contain a remote code execu…9.6
• CVE-2022-38546A DNS misconfiguration was found in Zyxel NBG7510 firmware v…9.8
• CVE-2022-38547A post-authentication command injection vulnerability in the…7.2
• CVE-2022-3855The 404 to Start WordPress plugin through 1.6.1 does not san…4.8
• CVE-2022-38550A stored cross-site scripting (XSS) vulnerability in the /we…5.4
• CVE-2022-38553Academy Learning Management System before v5.9.1 was discove…6.1