CVE-2022-26254

WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.84% chance of exploitation in the next 30 days, 55th percentile

Published

2022-03-27

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://youtu.be/b665r1ZfCg4

References

• CVE Record
• NVD entry

Related

• CVE-2022-26252
• CVE-2022-26255
• CVE-2022-26251
• CVE-2022-26258
• CVE-2022-26250
• CVE-2022-2626