彙總 lcnet 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 路徑處理缺陷與跨站腳本 等問題，部分漏洞可能導致 工作階段劫持，並影響 生產負載與軟體部署 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2022-39035 | Smart eVision has insufficient filtering for special characters in the POST Data parameter in the specific function. An unauthenticated remote attacker can inject JavaScript to perform XSS (Stored Cross-Site Scripting) attack. | [email protected] | 6.1 | 0.49% | 2022-09-28 | 2026-06-17 |
| CVE-2022-39034 | Smart eVision has a path traversal vulnerability in the Report API function due to insufficient filtering for special characters in URLs. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication, access restricted paths and download system files. | [email protected] | 6.5 | 1.17% | 2022-09-28 | 2026-06-17 |
| CVE-2022-39033 | Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service. | [email protected] | 9.8 | 1.49% | 2022-09-28 | 2026-06-17 |
| CVE-2022-39032 | Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service. | [email protected] | 8.8 | 0.73% | 2022-09-28 | 2026-06-17 |
| CVE-2022-39031 | Smart eVision has insufficient authorization for task acquisition function. An unauthorized remote attacker can exploit this vulnerability to acquire the Session IDs of other general users only. | [email protected] | 5.3 | 0.58% | 2022-09-28 | 2026-06-17 |
| CVE-2022-39030 | smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information. | [email protected] | 7.5 | 0.74% | 2022-09-28 | 2026-06-17 |
| CVE-2022-39029 | Smart eVision has inadequate authorization for the database query function. A remote attacker with general user privilege, who is not explicitly authorized to access the information, can access sensitive information. | [email protected] | 6.5 | 0.64% | 2022-09-28 | 2026-06-17 |