Lucene search

CVE-2022-3720

🗓️ 21 Nov 2022 11:20:15Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 51 Views🌐 WEB

The Event Monster WordPress plugin before 1.2.0 is vulnerable to SQL Injection

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 7
wpexploit	Event Monster < 1.2.1 - Admin+ SQLi	31 Oct 202200:00	–	wpexploit
Patchstack	WordPress Event Monster plugin <= 1.2.0 - Auth. SQL Injection (SQLi) vulnerability	31 Oct 202200:00	–	patchstack
CNVD	WordPress Event Monster SQL Injection Vulnerability	23 Nov 202200:00	–	cnvd
WPVulnDB	Event Monster < 1.2.1 - Admin+ SQLi	31 Oct 202200:00	–	wpvulndb
Cvelist	CVE-2022-3720 Event Monster < 1.2.1 - Admin+ SQLi	21 Nov 202200:00	–	cvelist
Prion	Sql injection	21 Nov 202211:15	–	prion
NVD	CVE-2022-3720	21 Nov 202211:15	–	nvd

Nvd

Vulners

Node

awplife event_monsterRange<1.2.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "Event Monster",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.2.0"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/0139a23c-4896-4aef-ab56-dcf7f07f01e5

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/edit.php?post_type=awl_event_monster&page=em-visitors-page	The plugin does not validate and escape parameters before using them in SQL statements, allowing for potential SQL Injection.	CWE-89, CWE-20
nonce	request body	/wp-admin/edit.php?post_type=awl_event_monster&page=em-visitors-page	The plugin does not validate and escape parameters before using them in SQL statements, allowing for potential SQL Injection.	CWE-89, CWE-20
id	request body	/wp-admin/edit.php?post_type=awl_event_monster&page=em-visitors-page	The plugin does not validate and escape parameters before using them in SQL statements, allowing for potential SQL Injection.	CWE-89, CWE-20

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

21 Nov 2022 11:15Current

7.1High risk

Vulners AI Score7.1

CVSS37.2

EPSS0.00279