Every CVESearch/Get API key

CVE-2022-29603

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select...

8.1 High

CVE-2022-29603 is a high vulnerability (CVSS 8.1) in Universis Universis-api, published April 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. No source names a fixed version.

What does this mean?
Severity
8.1 HighCVSS 3.1, NVD
Exploit chance
1.45%EPSS, 73rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.45%Up 0.4 points since Apr 25, 2022
90%50%10%1%

Affected products

What each source reports

NVD Score used8.1

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades.

Record
CVE-2022-29603
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
5.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:N
Weakness
CWE-89
Updated
2026-11-02
CVE ListNo score

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades.

Record
CVE-2022-29603
Updated
2026-11-02
EUVDEUVD-2022-33934No score

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades.

Record
EUVD-2022-33934
Updated
2026-11-03
GitHub AdvisoriesGHSA-xr76-xjjc-j8mg8.1

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select...

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades.

Record
GHSA-xr76-xjjc-j8mg
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVNo score

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API endpoints. A remote authenticated attacker could send crafted SQL statements to a vulnerable endpoint (such as /api/students/me/messages/) to, for example, retrieve personal information or change grades.

Record
CVE-2022-29603
Updated
2026-11-02

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open