The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/78054d08-0227-426c-903d-d146e0919028 | Third Party Advisory |
Configurations
History
07 Nov 2023, 03:52
Type | Values Removed | Values Added |
---|---|---|
CWE |
14 Dec 2022, 22:00
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
References | (MISC) https://wpscan.com/vulnerability/78054d08-0227-426c-903d-d146e0919028 - Third Party Advisory | |
First Time |
Icegram
Icegram email Subscribers \& Newsletters |
|
CPE | cpe:2.3:a:icegram:email_subscribers_\&_newsletters:*:*:*:*:*:wordpress:*:* |
12 Dec 2022, 18:17
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-12-12 18:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-3981
Mitre link : CVE-2022-3981
CVE.ORG link : CVE-2022-3981
JSON object : View
Products Affected
icegram
- email_subscribers_\&_newsletters
CWE
No CWE.