CVE-2022-30529

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-22 · updated 2026-06-17
Weakness: CWE-434

Description

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php.

Affected products

Isic.Lk Project Isic.Lk: through 2018-02-13

References

https://github.com/asith-eranga/isic
https://github.com/killmonday/isic.lk-RCE
https://github.com/asith-eranga/isic
https://github.com/killmonday/isic.lk-RCE

Get alerted when CVE-2022-30529 or the next vulnerability affects your stack