PatchTheCVE: ovaledgehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-30361: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /userhttps://patchthecve.com/cve/CVE-2022-30361.htmlhttps://patchthecve.com/cve/CVE-2022-30361.htmlWed, 17 Jun 2026 04:43:33 +0000MEDIUM 5.3: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserType. No authentication is required. The information disclosed is associated with the registered user ID, status, email address, role(s), user type, license type, and personal detailCVE-2022-30360: OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities vihttps://patchthecve.com/cve/CVE-2022-30360.htmlhttps://patchthecve.com/cve/CVE-2022-30360.htmlWed, 17 Jun 2026 04:43:33 +0000MEDIUM 6.4: OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST request to /profile/updateProfile via the slackid or phone parameters. Authentication is required.CVE-2022-30359: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /userhttps://patchthecve.com/cve/CVE-2022-30359.htmlhttps://patchthecve.com/cve/CVE-2022-30359.htmlWed, 17 Jun 2026 04:43:33 +0000MEDIUM 4.3: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, role(s), user type, license type, aCVE-2022-30358: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updahttps://patchthecve.com/cve/CVE-2022-30358.htmlhttps://patchthecve.com/cve/CVE-2022-30358.htmlWed, 17 Jun 2026 04:43:33 +0000HIGH 8.8: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /user/updatePassword via the userId and newPsw parameters. Authentication is required.CVE-2022-30357: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/uhttps://patchthecve.com/cve/CVE-2022-30357.htmlhttps://patchthecve.com/cve/CVE-2022-30357.htmlWed, 17 Jun 2026 04:43:33 +0000HIGH 8.8: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.CVE-2022-30356: OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/ahttps://patchthecve.com/cve/CVE-2022-30356.htmlhttps://patchthecve.com/cve/CVE-2022-30356.htmlWed, 17 Jun 2026 04:43:33 +0000MEDIUM 4.7: OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.CVE-2022-30355: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/uhttps://patchthecve.com/cve/CVE-2022-30355.htmlhttps://patchthecve.com/cve/CVE-2022-30355.htmlWed, 17 Jun 2026 04:43:32 +0000CRITICAL 9.8: OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required.CVE-2022-30354: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /userhttps://patchthecve.com/cve/CVE-2022-30354.htmlhttps://patchthecve.com/cve/CVE-2022-30354.htmlWed, 17 Jun 2026 04:43:32 +0000HIGH 7.5: OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserWithTeam. Authentication is required. The information disclosed is associated with all registered user ID numbers.