PT-2026-2370 · Unknown · Viaviweb Wallpaper

[Edd13Mora] · Published 2026-01-13 · Updated 2026-01-14 · CVE-2022-50894

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VIAVIWEB Wallpaper Admin version 1.0

Description The software contains an SQL injection issue that allows authenticated attackers to manipulate database queries. Attackers can inject SQL code through the img id parameter. Specifically, sending crafted GET requests to the ''edit gallery image.php'' endpoint with malicious img id values allows attackers to extract database information.

Recommendations Apply a fix to sanitize the img id parameter in the ''edit gallery image.php'' endpoint to prevent SQL injection.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-50894

Affected Products

Viaviweb Wallpaper

References · 6

• 🔥 https://exploit-db.com/exploits/51033 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50894 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50894 · Vendor Advisory
• https://viaviweb.com · Note
• https://vulncheck.com/advisories/viaviweb-wallpaper-admin-sql-injection-via-editgalleryimagephp · Note
• https://twitter.com/CVEnew/status/2011383030808514969 · Twitter Post