CVE-2023-6035 EazyDocs < 2.3.4 - Subscriber + SQLi

2023-12-1119:22:37

WPScan

www.cve.org

eazydocs

wordpress

sql injection

0.001 Low

EPSS

Percentile

19.4%

JSON

The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape “data” parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "EazyDocs",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "2.3.4"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/44f5a29a-05f9-40d2-80f2-6fb2bda60d79

0.001 Low

EPSS

Percentile

19.4%

JSON

Related for CVELIST:CVE-2023-6035