CVE-2022-28607

2022-12-0100:00:00

mitre

www.cve.org

isic

tour booking

sensitive information

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

58.8%

JSON

An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/mod_users/controller.php.

References

github.com/killmonday/isic.lk-RCE