CVE-2022-35216— ITPison OMICARD EDM - Use of Hard-coded Credentials
Quick assessment
Affected
ITPison OMICARD EDM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ITPison OMICARD EDM是中国ITPison公司的一个高速电子报 EDM 行销发送系統。 ITPison OMICARD EDM v5.8到v6.0版本存在安全漏洞，该漏洞源于OMICARD EDM 的邮件图片转发功能存在路径遍历，攻击者可以利用此漏洞绕过身份验证并访问任意系统文件。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-35216
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ITPison OMICARD EDM - Use of Hard-coded Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
OMICARD EDM’s mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
ITPison OMICARD EDM 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ITPison OMICARD EDM是中国ITPison公司的一个高速电子报 EDM 行销发送系統。 ITPison OMICARD EDM v5.8到v6.0版本存在安全漏洞，该漏洞源于OMICARD EDM 的邮件图片转发功能存在路径遍历，攻击者可以利用此漏洞绕过身份验证并访问任意系统文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ITPison | OMICARD EDM | 5.8 ~ 6.0 | - |
|
II. Public POCs for CVE-2022-35216
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-35216
请登录查看更多情报信息。
Other References for CVE-2022-35216 (2)
-
https://www.twcert.org.tw/tw/cp-132-6374-1c6c9-1.html x_refsource_MISC
Same Patch Batch · ITPison · 2022-08-04 · 4 CVEs total
| CVE-2022-32964 | 9.8 CRITICAL | ITPison OMICARD EDM - SQL Injection |
| CVE-2022-32965 | 9.8 CRITICAL | ITPison OMICARD EDM - Use of Hard-coded Credentials |
| CVE-2022-32963 | 7.5 HIGH | ITPison OMICARD EDM - Path Traversal-1 |
IV. Related Vulnerabilities
Same product: OMICARD EDM
-
CVE-2026-10597
ITPison｜OMICARD EDM - Insecure Direct Object Reference -
CVE-2024-4894
ITPison OMICARD EDM - Server-Side Request Forgery -
CVE-2023-28700
ITPison OMICARD EDM - Arbitrary File Upload -
CVE-2022-32965
ITPison OMICARD EDM - Use of Hard-coded Credentials -
CVE-2022-32964
ITPison OMICARD EDM - SQL Injection
Same vendor: ITPison
-
CVE-2026-10597
ITPison｜OMICARD EDM - Insecure Direct Object Reference -
CVE-2024-4894
ITPison OMICARD EDM - Server-Side Request Forgery -
CVE-2023-48373
ITPison OMICARD EDM 's SMS - Path Traversal -
CVE-2023-48372
ITPison OMICARD EDM 's SMS - SQL Injection -
CVE-2023-48371
ITPison OMICARD EDM 's SMS - Arbitrary File Upload
Same weakness: CWE-22
-
CVE-2026-89039
CVE-2026-89039 CVE Record -
CVE-2026-63266
Arbitrary file write via calcext:data-mappings, sql provider -
CVE-2026-105286
Totolink A3002MU File Upload formUploadFile sub_44B250 path -
CVE-2026-104805
Mitel MiVoice Office 400 Backup Restoration Arbitrary File W -
CVE-2026-105293
Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Han
V. Comments for CVE-2022-35216
No comments yet