CVE-2022-47945

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

• CWE-22
• CWE-22

• https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099Patch, Third Party Advisory
• https://github.com/top-think/framework/compare/v6.0.13...v6.0.14Patch, Third Party Advisory
• https://tttang.com/archive/1865/Exploit, Third Party Advisory
• https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099Patch, Third Party Advisory
• https://github.com/top-think/framework/compare/v6.0.13...v6.0.14Patch, Third Party Advisory
• https://tttang.com/archive/1865/Exploit, Third Party Advisory

Published

Dec 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47939An issue was discovered in ksmbd in the Linux kernel 5.15 th…9.8
• CVE-2022-4794The AAWP WordPress plugin before 3.12.3 can be used to abuse…7.5
• CVE-2022-47940An issue was discovered in ksmbd in the Linux kernel 5.15 th…8.1
• CVE-2022-47941An issue was discovered in ksmbd in the Linux kernel 5.15 th…7.5
• CVE-2022-47942An issue was discovered in ksmbd in the Linux kernel 5.15 th…8.8
• CVE-2022-47943An issue was discovered in ksmbd in the Linux kernel 5.15 th…8.1
• CVE-2022-47946An issue was discovered in the Linux kernel 5.10.x before 5.…5.5
• CVE-2022-47949The Nintendo NetworkBuffer class, as used in Animal Crossing…9.8
• CVE-2022-4795The Galleries by Angie Makes WordPress plugin through 1.67 d…5.4
• CVE-2022-47950An issue was discovered in OpenStack Swift before 2.28.1, 2.…6.5
• CVE-2022-47951An issue was discovered in OpenStack Cinder before 19.1.2, 2…5.7
• CVE-2022-47952lxc-user-nic in lxc through 5.0.1 is installed setuid root, …3.3