CVE-2022-46764 CRITICAL

CVE-2022-46764

Vendor Trueconf

Product TrueConf Server

Weakness CWE-89 · SQLi

Published December 27, 2022

Last update February 27, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.

Key dates

02Disclosure timeline

December 27, 2022 CVE published

February 27, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-46764 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-9008 itsourcecode Online Tour and Travel Management System sms_setting.php sql injection CVE-2021-24726 WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL Injection CVE-2025-9600 itsourcecode Apartment Management System member_type_setup.php sql injection CVE-2022-31058 SQL injection via the field name of a tracker in Tuleap CVE-2025-30524 WordPress Product Catalog plugin <= 1.0.4 - SQL Injection vulnerability