CVE-2022-45088

9.8 CRITICAL

Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion

Published: 2023-02-12 · Last updated: 2026-05-18

Severity and scoring

CVSS: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-20

Affected products

Vendor	Product
gruparge	smartpower_web

Description

Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion. This issue affects Smartpower Web: before 23.01.01.

Source: NVD

References

Related CVEs

Same vendor

CVE-2022-4557 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Syste... (9.8 CRITICAL)
CVE-2022-45091 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Syste... (5.4 MEDIUM)
CVE-2022-45090 — Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection (8.8 HIGH)
CVE-2022-45089 — Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection (8.8 HIGH)
CVE-2022-45087 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Syste... (6.1 MEDIUM)

Same CWE

CVE-2026-12191 — A vulnerability was found in Comma AI Openpilot 0.11 (7.8 HIGH)
CVE-2026-45013 — ApostropheCMS is an open-source Node.js content management system (8.1 HIGH)
CVE-2026-54133 — jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP app... (9.8 CRITICAL)
CVE-2026-47196 — Quest Bot is an opensource Discord Bot
CVE-2026-50633 — A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an atta... (8.1 HIGH)