CVE-2022-44291

CriticalCVSS 9.8

Published: 02/12/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.62%

88th percentile - higher than 88% of all known CVEs

Summary

A SQL injection vulnerability was discovered in webTareas 2.4p5 in the phasesets.php file via the id parameter. An attacker can manipulate this parameter to execute unauthorized database queries.

Risk Assessment

The risk involves potential unauthorized access to sensitive data, modification, or deletion, which could compromise the confidentiality and integrity of the system.

Recommendation

Immediately update webTareas to the latest available version that fixes this vulnerability. If an update is not possible, implement input validation and sanitization for the id parameter in phasesets.php.

Original NVD description (English source)

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.