In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.
id: CVE-2022-27228
info:
name: Bitrix Site Manager - Remote Code Execution
author: theamanrawat
...