CVE-2022-42175

HighCVSS 8.8

Published: 05/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

46th percentile - higher than 46% of all known CVEs

Summary

Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.

Risk Assessment

The risk involves unauthorized takeover of other customers' servers, potentially leading to data confidentiality, integrity, and availability breaches.

Recommendation

Immediately update the SolusVM module to the latest version and implement access control mechanisms such as object reference validation.

Other vulnerabilities in SolusVM

CVE-2026-105474Critical
A server-side template injection (SSTI) vulnerability exists in SolusVM 2 up to version 2.0.0-44576, allowing remote authenticated users to execute arbitrary code as root.

Original NVD description (English source)

Insecure Direct Object Reference vulnerability in WHMCS module SolusVM 1 4.1.2 allows an attacker to change the password and hostname of other customer servers without authorization.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS