CVE-2022-2958 BadgeOS < 3.7.1.3 - Subscriber+ SQLi

2022-09-1914:01:05

CWE-89

WPScan

www.cve.org

cve-2022-2958

badgeos

sql injection

EPSS

0.001

Percentile

37.7%

JSON

The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections

CNA Affected

[
  {
    "product": "BadgeOS",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.7.1.3",
        "status": "affected",
        "version": "3.7.1.3",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a

EPSS

0.001

Percentile

37.7%

JSON

Related for CVELIST:CVE-2022-2958