CVE-2022-2840

🗓️ 19 Sep 2022 00:00:00Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 76 Views🌐 WEB

The Zephyr Project Manager WordPress plugin before 3.2.5 SQL injection vulnerabilit

Reporter	Title	Published	Views	Family All 16
0day.today	Wordpress Zephyr Project Manager 3.2.42 Plugin - Multiple SQL injection Vulnerabilities	6 Oct 202200:00	–	zdt
ATTACKERKB	CVE-2022-2840	19 Sep 202214:15	–	attackerkb
Circl	CVE-2022-2840	6 Oct 202200:00	–	circl
CNNVD	WordPress plugin Zephyr Project Manager SQL注入漏洞	19 Sep 202200:00	–	cnnvd
Cvelist	CVE-2022-2840 Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi	19 Sep 202200:00	–	cvelist
Exploit DB	Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi	6 Oct 202200:00	–	exploitdb
EUVD	EUVD-2022-35074	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2840	19 Sep 202214:15	–	nvd
OSV	CVE-2022-2840	19 Sep 202214:15	–	osv
Packet Storm	WordPress Zephyr Project Manager 3.2.42 SQL Injection	7 Oct 202200:00	–	packetstorm

NVD

Vulners

Node

zephyr-one zephyr_project_managerRange<3.2.5wordpress

[
  {
    "vendor": "Unknown",
    "product": "Zephyr Project Manager",
    "versions": [
      {
        "version": "3.2.5",
        "status": "affected",
        "lessThan": "3.2.5",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html
wpscan	www.wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c

Parameter	Position	Path	Description	CWE
project_id	request body	/wp-admin/admin-ajax.php	SQL injection via unsanitised project_id parameter in zpm_view_project AJAX action.	CWE-89
task_id	request body	/wp-admin/admin-ajax.php	SQL injection via unsanitised task_id parameter in zpm_view_task AJAX action.	CWE-89

17 Jun 2026 04:42Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.0961

CWE-89