CVE-2022-23320

HighCVSS 7.5

Published: 07/02/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.63%

73th percentile - higher than 73% of all known CVEs

Summary

XMPie uStore version 12.3.7244.0 allows administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.

Risk Assessment

The risk involves potential unauthorized access to confidential data stored in the database, which could lead to leakage of customer or corporate information.

Recommendation

Immediately change default administrator passwords and restrict SQL report generation privileges to trusted users only.

Other vulnerabilities in XMPie uStore

CVE-2022-23321Medium
A persistent cross-site scripting (XSS) vulnerability was discovered in the XMPie UStore application version 12.3.7244.0 in the administrative panel when editing users. The vulnerability exists in two input fields, allowing injection of malicious scripts.

Original NVD description (English source)

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application ships with default administrative credentials, an attacker may authenticate into the application and exfiltrate sensitive information from the database.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS