CVE-2022-23168

The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'--

CVE-2022-23169

attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel.