CVE-2022-50894

Medium · 6.5

CVSS

6.5

EPSS

0.5%

Published

Jan 13, 2026

CISA due date

—

The record

VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id parameter. Attackers can send GET requests to edit_gallery_image.php with malicious img_id values to extract database information.

Affected packages

Ecosystem	Package	Introduced	Fixed