CVE-2022-21644: USOC is an open source CMS with a focus on simplicity

Q: How do I fix CVE-2022-21644?

useful simple open-source cms: upgrade to pb2.4bfx2. Exact commands for each OS are on this page.

Q: Is CVE-2022-21644 being exploited?

CVE-2022-21644 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2022-21644 affect?

CVE-2022-21644 affects useful simple open-source cms. Severity is critical (CVSS 9.1). USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The o

Q: How urgent is CVE-2022-21644?

Priority 48/100. Critical severity

This month

CRITICAL 9.1UPGRADE

CVE-2022-21644 is a critical-severity flaw (CVSS 9.1) affecting useful simple open-source cms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.

Why this priority

Critical severity

A fixed release or distro patch exists.

Risk facts

CVSS score	9.1 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	High
User interaction	None
EPSS exploit chance	1.1% (top 35%)
CISA exploited list	No
Weakness	CWE-89
Published	2022-01-04
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: useful simple open-source cms project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-01-04 20:15 UTCPublished CVE record published
2026-06-17 04:26 UTCUpdated Record last modified

useful simple open-source cms project useful simple open-source cms UPGRADE

Affected: < pb2.4bfx2

Fixed in: pb2.4bfx2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy useful-simple-open-source-cms || rpm -q useful-simple-open-source-cms || useful-simple-open-source-cms --version

2. UPGRADE to pb2.4bfx2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade useful-simple-open-source-cms

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade useful-simple-open-source-cms

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-21644?

useful simple open-source cms: upgrade to pb2.4bfx2. Exact commands for each OS are on this page.

Is CVE-2022-21644 being exploited?

CVE-2022-21644 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-21644 affect?

CVE-2022-21644 affects useful simple open-source cms. Severity is critical (CVSS 9.1). USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The o

How urgent is CVE-2022-21644?

Priority 48/100. Critical severity

Software pages

PHP vulnerabilities

Related CVEs

CVE-2022-21666 HIGH 7.2 UPGRADE Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers
CVE-2022-21643 CRITICAL 10.0 UPGRADE USOC is an open source CMS with a focus on simplicity

References

← Back to latest CVEs