CVE-2022-25228: Auieo Candidats

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=show' via the 'userID' parameter, in '/index.php?m=candidates&a=show' via the 'candidateID', in '/index.php?m=joborders&a=show' via the 'jobOrderID' and '/index.php?m=companies&a=show' via the 'companyID' parameter

Affected products

• Auieo Candidats: version 3.0.0 only

Published 2022-08-18. Last modified 2026-06-17.