← Zuruck zu CVEs

CVE-2022-2840

CRITICAL

9.8

Beschreibung

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht9/19/2022

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

zephyr-one:zephyr_project_manager

Schwachen (CWE)

CWE-89CWE-89

Referenzen

http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html(contact@wpscan.com)

https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c(contact@wpscan.com)

http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.