CVE-2022-38619

CriticalCVSS 9.8

Published: 21/09/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.76%

51th percentile - higher than 51% of all known CVEs

Summary

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf. An attacker can manipulate this parameter to execute unauthorized database queries.

Risk Assessment

The risk includes potential leakage of sensitive data, modification or deletion of database records, and privilege escalation within the SmartVista system.

Recommendation

Immediately update SmartVista SVFE2 to the latest version and apply parameterized SQL queries or input validation for the UserForm:j_id90 parameter.

Original NVD description (English source)

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.