CVE-2022-28093

CriticalCVSS 9.8

Published: 25/04/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.79%

76th percentile - higher than 76% of all known CVEs

Summary

SCBS Online Sports Venue Reservation System v1.0 was found to have a local file inclusion (LFI) vulnerability. This allows an attacker to execute arbitrary code via a crafted PHP file.

Risk Assessment

An attacker can remotely execute malicious code on the server, leading to full system compromise, data theft, or disruption of the reservation service.

Recommendation

Immediately update the system to the latest available version or apply a patch that fixes the LFI vulnerability. Additionally, implement input validation and restrict file inclusion to trusted directories.

Original NVD description (English source)

SCBS Online Sports Venue Reservation System v1.0 was discovered to contain a local file inclusion vulnerability which allow attackers to execute arbitrary code via a crafted PHP file.