Critical severity9.8NVD Advisory· Published Jul 13, 2022· Updated Jun 17, 2026

CVE-2022-35857

Description

kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.

Affected products

kvf-admin/kvf-admindescription
Kalvingit/Kvf Adminllm-fuzzy
Range: <=2022-02-12

Patches

Vulnerability mechanics

References

github.com/kalvinGit/kvf-admin/issues/16nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000