CVE-2022-4871 ummmmm nflpick-em.com LoadUsers.php _Load_Users sql injection

🗓️ 03 Jan 2023 11:00:36Reported by GoogleType

osv🔗 osv.dev👁 32 Views

A remote SQL injection vulnerability found in ummmmm nflpick-em.com up to version 2.2.x allows remote attackers to manipulate the sort argument in _Load_Users function of LoadUsers.php, leading to a remote code execution. A patch with identifier dd77a35942f527ea0beef5e0ec62b92e8b93211e is available to fix this issue. Access to the JSON entrypoint is restricted to admin accounts only

Reporter	Title	Published	Views	Family All 8
CNNVD	NFLPick-Em.com SQL注入漏洞	3 Jan 202300:00	–	cnnvd
CVE	CVE-2022-4871	3 Jan 202311:00	–	cve
Cvelist	CVE-2022-4871 ummmmm nflpick-em.com LoadUsers.php _Load_Users sql injection	3 Jan 202311:00	–	cvelist
EUVD	EUVD-2022-52131	3 Oct 202520:07	–	euvd
NVD	CVE-2022-4871	3 Jan 202312:15	–	nvd
Prion	Sql injection	3 Jan 202312:15	–	prion
Positive Technologies	PT-2023-15887 · Unknown · Nflpick-Em.Com	3 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-4871	23 May 202500:30	–	redhatcve

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4871.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-4871
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/ummmmm/nflpick-em.com/commit/dd77a35942f527ea0beef5e0ec62b92e8b93211e

15 Jul 2026 01:48Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.14.7

EPSS0.00651