{"id":"CVE-2022-44785","aliases":["EUVD-2022-47717","GHSA-xm35-83v5-99x8"],"status":"published","title":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to...","description":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00893,"percentile":0.59944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2022-11-21T00:00:00Z","modified":"2026-06-17T05:08:54Z","products":[{"vendor":"maggioli","product":"appalti_\\\u0026_contratti"}],"references":[{"url":"https://members.backbox.org/maggioli-appalti-contratti-multiple-vulnerabilities/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44785"},{"url":"https://members.backbox.org/maggioli-appalti-contratti-multiple-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-xm35-83v5-99x8"}],"sources":{"cve":[{"id":"CVE-2022-44785","description":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.","status":"published","published":"2022-11-21T00:00:00Z","modified":"2025-04-29T15:51:22.369Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2022-47717","description":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.","status":"published","published":"2022-11-21T00:00:00Z","modified":"2025-04-29T15:51:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-xm35-83v5-99x8","title":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to...","description":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.","status":"published","published":"2022-11-22T00:30:32Z","modified":"2025-04-29T18:31:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:03.587511Z"}],"nvd":[{"id":"CVE-2022-44785","description":"An issue was discovered in Appalti \u0026 Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.","status":"published","published":"2022-11-21T23:15:13.14Z","modified":"2026-06-17T05:08:54.903Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:07:32.395456Z"}]}}