← Vulnerability feed

Vulnerability record · CVE-2022-23346 · published 21 March 2022

CVE-2022-23346: Bigantsoft bigant server unrestricted file upload vulnerability

Bigantsoft · Bigant Server

BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues.

8.8 CVSS 3.1 High EPSS 1.4% · top 28.5% CWE-434 · Unrestricted file upload
8.8CVSS 3.1 base score, v2 6.5
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
9 Jul 2026Last modified by NVD

Description

BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23346 ExploitThird Party Advisory
https://www.bigantsoft.com/ Vendor Advisory
https://github.com/bzyo/cve-pocs/tree/master/CVE-2022-23346 ExploitThird Party Advisory
https://www.bigantsoft.com/ Vendor Advisory

Track CVE-2022-23346 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-0364Bigantsoft bigant server authentication bypass via alternate path vulnerabilityBigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An una…EPSS 1.9%8.8CVE-2022-23349Bigantsoft bigant server cross-site request forgery vulnerabilityBigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF).EPSS 0.65%7.5CVE-2022-26281Bigantsoft bigant server missing encryption vulnerabilityBigAnt Server v5.6.06 was discovered to contain an incorrect access control issue.EPSS 0.95%7.5CVE-2022-23345Bigantsoft bigant server missing authentication for critical function vulnerabilityBigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control.EPSS 1.6%7.5CVE-2022-23347Bigantsoft bigant server path traversal vulnerabilityBigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.EPSS 13%7.5CVE-2022-23352Bigantsoft bigant server vulnerabilityAn issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).EPSS 1.6%5.4CVE-2022-23350Bigantsoft bigant server cross-site scripting vulnerabilityBigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability.EPSS 0.61%5.3CVE-2022-23348Bigantsoft bigant server vulnerabilityBigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.EPSS 3.3%

Source: NIST National Vulnerability Database (record CVE-2022-23346), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.