CVE-2022-35857: Kvf-Admin Project Kvf-Admin

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.

Affected products

• Kvf-Admin Project Kvf-Admin: up to and including 2022-02-12

Published 2022-07-13. Last modified 2026-06-17.