Lucene search

PatchstackCVELIST:CVE-2022-25607

HistoryMar 18, 2022 - 6:00 p.m.

CVE-2022-25607 WordPress FV Flowplayer Video Player plugin <= 7.5.15.727 - SQL Injection (SQLi) vulnerability

2022-03-1818:00:28

CWE-89

Patchstack

www.cve.org

wordpress

fv flowplayer

sql injection

CVSS3

6.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

37.0%

JSON

Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).

CNA Affected

[
  {
    "product": "FV Flowplayer Video Player (WordPress plugin)",
    "vendor": "FolioVision",
    "versions": [
      {
        "lessThanOrEqual": "7.5.15.727",
        "status": "affected",
        "version": "<= 7.5.15.727",
        "versionType": "custom"
      }
    ]
  }
]

References

patchstack.com/database/vulnerability/fv-wordpress-flowplayer/wordpress-fv-flowplayer-video-player-plugin-7-5-15-727-sql-injection-sqli-vulnerability

wordpress.org/plugins/fv-wordpress-flowplayer/#developers