VULNERABILITY INTELLIGENCE

CVE-2022-44006

CVSS score9.8 CRITICAL

EPSS probability2.07%

CISA KEVNot currently listed

Published2022-11-16

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthenticated update function permits writing files outside the intended target location. Achieving remote code execution is possible, e.g., by uploading an executable file.

Weakness classification

nvd@nist.gov: CWE-22
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-22

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory