Backclick is a narrowly scoped vendor with a single product whose vulnerability profile skews strongly toward critical-severity outcomes across a focused set of application-layer and access-control weakness classes. The recurring vulnerabilities cluster around missing authentication controls, path-traversal flaws, authorization bypasses, code-execution vectors via dynamic resource handling, and cross-site scripting, patterns that reflect a web application exposed to input validation and privilege-enforcement demands. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Backclick over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-44006CRITICAL An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthenticated update function p | Nov 16, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-44004CRITICAL An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password-reset process for an | Nov 16, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-44003CRITICAL An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection at various locations. | Nov 16, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-43999CRITICAL An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server. | Nov 16, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-44001CRITICAL An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed. | Nov 17, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-44000CRITICAL An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server. | Nov 16, 2022 | 9.8 | 29 | NO | NO |
CVE-2022-44007HIGH An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authent | Nov 16, 2022 | 8.8 | 27 | NO | NO |
CVE-2022-44002MEDIUM An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross-site scripting (XSS) | Nov 16, 2022 | 6.1 | 22 | NO | NO |
CVE-2022-44008MEDIUM An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retrieved by accessing the back-end Tomcat server directly. | Nov 16, 2022 | 6.5 | 22 | NO | NO |
CVE-2022-44005MEDIUM An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vulnerable to the enumera | Nov 16, 2022 | 5.3 | 20 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Backclick.
Media articles that mention a CVE ID that affects a product developed by Backclick — matched by CVE ID, not by vendor name.