CVE-2022-0349 NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection

2022-03-0708:16:27

CWE-89

WPScan

www.cve.org

0.024 Low

EPSS

Percentile

90.0%

JSON

The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection

CNA Affected

[
  {
    "product": "NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.9",
        "status": "affected",
        "version": "2.3.9",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a

0.024 Low

EPSS

Percentile

90.0%

JSON

Related for CVELIST:CVE-2022-0349