Описание
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
Ссылки
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.9.5.5 (включая)
cpe:2.3:a:xnau:participants_database:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 79%
0.01311
Низкий
7.5 High
CVSS3
6 Medium
CVSS2
Дефекты
CWE-89
Связанные уязвимости
github
больше 3 лет назад
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).
EPSS
Процентиль: 79%
0.01311
Низкий
7.5 High
CVSS3
6 Medium
CVSS2
Дефекты
CWE-89