CVE-2022-47636

A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.

• CWE-427

• http://packetstormsecurity.com/files/174127/OutSystems-Service-Studio-11.53.30-DLL-Hijacking.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/51678Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/174127/OutSystems-Service-Studio-11.53.30-DLL-Hijacking.htmlExploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/51678Exploit, Third Party Advisory, VDB Entry

Published

Aug 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47630Trusted Firmware-A through 2.8 has an out-of-bounds read in …7.4
• CVE-2022-47631Razer Synapse through 3.7.1209.121307 allows privilege escal…7.8
• CVE-2022-47632Razer Synapse before 3.7.0830.081906 allows privilege escala…6.8
• CVE-2022-47633An image signature validation bypass vulnerability in Kyvern…8.1
• CVE-2022-47634M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 …8.1
• CVE-2022-47635Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.2022121…9.8
• CVE-2022-47637The installer in XAMPP through 8.1.12 allows local users to …6.7
• CVE-2022-4764The Simple File Downloader WordPress plugin through 1.0.4 do…5.4
• CVE-2022-47648An Improper Access Control vulnerability allows an attacker …8.8
• CVE-2022-4765The Portfolio for Elementor WordPress plugin before 2.3.1 do…5.4
• CVE-2022-47653GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffe…7.8
• CVE-2022-47654GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffe…7.8