CVE-2022-26159

The record

The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.

Affected packages

Related vulnerabilities

• CVE-2026-14953 A low-privileged remote attacker can enumerate all configured users and identify which… CWE-425
• CVE-2026-76799 A weakness has been identified in code-projects Login Registration System 1.0. CWE-425
• CVE-2026-19903 A vulnerability has been found in SourceCodester Online Clothing Store 1.0. CWE-425
• CVE-2026-21760 HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced… CWE-425
• CVE-2026-13533 A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. CWE-425
• CVE-2026-10521 An high privileged remote attacker can access a hidden configuration method, that should… CWE-425
• CVE-2026-9610 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9… CWE-425
• CVE-2026-34028 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes… CWE-425