CVE-2022-2765: company_website_cms_project company_website_cms Improper Authentication
Vulnerability summary
CVE-2022-2765 is a critical (CVSS 9.8) Improper Authentication vulnerability in company_website_cms_project company_website_cms. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 66.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 11-08-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability was found in SourceCodester Company Website CMS 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /dashboard/settings. The manipulation leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206161 was assigned to this vulnerability.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
+0.07 pp
From 1.09% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundVul
Maturity: poc
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Company_website_cms_project1 product
Sourcecodester1 product
2 vendors · 2 products
References
2 links- github.com/ch0ing/vul/blob/main/WebRay.com.cn/Company%20Website%20CMS--.mdX Refsource MISCExploitThird Party Advisory