Описание
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 115 (исключая)
cpe:2.3:a:getlasso:simple_urls:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 68%
0.00578
Низкий
8.8 High
CVSS3
7.7 High
CVSS3
Дефекты
Связанные уязвимости
CVSS3: 8.8
github
почти 3 года назад
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
EPSS
Процентиль: 68%
0.00578
Низкий
8.8 High
CVSS3
7.7 High
CVSS3