Vulnerability · Published Jan 13, 2026 · Assigned by VulnCheck
CVE-2022-50894VIAVIWEB Wallpaper Admin 1.0 SQL Injection via edit_gallery_image.php
Medium 6.5
In plain English
A medium-severity SQL injection in VIAVIWEB Wallpaper Admin from VIAVIWEB. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id parameter. Attackers can send GET requests to edit_gallery_image.php with malicious img_id values to extract database information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VIAVIWEB | VIAVIWEB Wallpaper Admin | 1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-51033 exploit
- Vendor Homepage product
- VulnCheck Advisory: VIAVIWEB Wallpaper Admin 1.0 SQL Injection via edit_gallery_image.php third-party-advisory