CVE-2022-50892

High

Published: 13/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in VIAVIWEB Wallpaper Admin 1.0 allows attackers to bypass authentication by manipulating login credentials. Injecting a payload on the login page grants unauthorized access to the administrative interface.

Risk Assessment

The risk to the organization is unauthorized control over the admin panel, potentially leading to content modification, data theft, or further attacks on the infrastructure.

Recommendation

Apply patches or updates immediately, and use parameterized SQL queries and input validation to eliminate the vulnerability.

Other vulnerabilities in VIAVIWEB Wallpaper Admin

CVE-2022-50893Critical
VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a malicious PHP file via the add_gallery_image.php endpoint to execute arbitrary code on the server.

Original NVD description (English source)

VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers can exploit the login page by injecting 'admin' or 1=1-- - payload to gain unauthorized access to the administrative interface.