PatchTheCVE: merchandise online store projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-42237: A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account.https://patchthecve.com/cve/CVE-2022-42237.htmlhttps://patchthecve.com/cve/CVE-2022-42237.htmlWed, 17 Jun 2026 05:04:33 +0000CRITICAL 9.8: A SQL Injection issue in Merchandise Online Store v.1.0 allows an attacker to log in to the admin account.CVE-2022-42238: A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to thhttps://patchthecve.com/cve/CVE-2022-42238.htmlhttps://patchthecve.com/cve/CVE-2022-42238.htmlWed, 17 Jun 2026 05:04:33 +0000HIGH 8.8: A Vertical Privilege Escalation issue in Merchandise Online Store v.1.0 allows an attacker to get access to the admin dashboard.CVE-2022-42236: A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit accouhttps://patchthecve.com/cve/CVE-2022-42236.htmlhttps://patchthecve.com/cve/CVE-2022-42236.htmlWed, 17 Jun 2026 05:04:33 +0000MEDIUM 5.4: A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form.CVE-2022-30423: Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user prohttps://patchthecve.com/cve/CVE-2022-30423.htmlhttps://patchthecve.com/cve/CVE-2022-30423.htmlWed, 17 Jun 2026 04:43:38 +0000CRITICAL 9.8: Merchandise Online Store v1.0 by oretnom23 has an arbitrary code execution (RCE) vulnerability in the user profile upload point in the system information.CVE-2022-30454: Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_prhttps://patchthecve.com/cve/CVE-2022-30454.htmlhttps://patchthecve.com/cve/CVE-2022-30454.htmlWed, 17 Jun 2026 04:43:40 +0000CRITICAL 9.8: Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product.CVE-2022-30402: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/managhttps://patchthecve.com/cve/CVE-2022-30402.htmlhttps://patchthecve.com/cve/CVE-2022-30402.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_sub_category&id=.CVE-2022-30401: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=.https://patchthecve.com/cve/CVE-2022-30401.htmlhttps://patchthecve.com/cve/CVE-2022-30401.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/?p=view_product&id=.CVE-2022-30400: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/orders/view_order.php?vhttps://patchthecve.com/cve/CVE-2022-30400.htmlhttps://patchthecve.com/cve/CVE-2022-30400.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/orders/view_order.php?view=user&id=.CVE-2022-30399: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/managhttps://patchthecve.com/cve/CVE-2022-30399.htmlhttps://patchthecve.com/cve/CVE-2022-30399.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=maintenance/manage_category&id=.CVE-2022-30398: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=orders/view_orderhttps://patchthecve.com/cve/CVE-2022-30398.htmlhttps://patchthecve.com/cve/CVE-2022-30398.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=orders/view_order&id=.CVE-2022-30396: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=inventory/manage_https://patchthecve.com/cve/CVE-2022-30396.htmlhttps://patchthecve.com/cve/CVE-2022-30396.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=inventory/manage_inventory&id=.CVE-2022-30395: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_chttps://patchthecve.com/cve/CVE-2022-30395.htmlhttps://patchthecve.com/cve/CVE-2022-30395.htmlWed, 17 Jun 2026 04:43:36 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart.CVE-2022-30393: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=product/manage_prhttps://patchthecve.com/cve/CVE-2022-30393.htmlhttps://patchthecve.com/cve/CVE-2022-30393.htmlWed, 17 Jun 2026 04:43:36 +0000HIGH 7.2: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/admin/?page=product/manage_product&id=.CVE-2022-30392: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_shttps://patchthecve.com/cve/CVE-2022-30392.htmlhttps://patchthecve.com/cve/CVE-2022-30392.htmlWed, 17 Jun 2026 04:43:35 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_category.CVE-2022-30391: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_chttps://patchthecve.com/cve/CVE-2022-30391.htmlhttps://patchthecve.com/cve/CVE-2022-30391.htmlWed, 17 Jun 2026 04:43:35 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category.CVE-2022-30387: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_ordehttps://patchthecve.com/cve/CVE-2022-30387.htmlhttps://patchthecve.com/cve/CVE-2022-30387.htmlWed, 17 Jun 2026 04:43:35 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.CVE-2022-30386: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_fhttps://patchthecve.com/cve/CVE-2022-30386.htmlhttps://patchthecve.com/cve/CVE-2022-30386.htmlWed, 17 Jun 2026 04:43:35 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured.CVE-2022-30385: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_ohttps://patchthecve.com/cve/CVE-2022-30385.htmlhttps://patchthecve.com/cve/CVE-2022-30385.htmlWed, 17 Jun 2026 04:43:35 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order.CVE-2022-30384: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_ihttps://patchthecve.com/cve/CVE-2022-30384.htmlhttps://patchthecve.com/cve/CVE-2022-30384.htmlWed, 17 Jun 2026 04:43:35 +0000CRITICAL 9.8: Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.CVE-2022-30381: Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggers_merch/classes/Master.php?f=delete_ihttps://patchthecve.com/cve/CVE-2022-30381.htmlhttps://patchthecve.com/cve/CVE-2022-30381.htmlWed, 17 Jun 2026 04:43:35 +0000MEDIUM 6.5: Merchandise Online Store v1.0 is vulnerable to file deletion via /vloggers_merch/classes/Master.php?f=delete_img.