Lucene search
HistoryJan 16, 2023 - 4:15 p.m.
CVE-2022-4447
wordpress plugin
sql injection
unauthenticated users
ajax action
fontsy
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.088
Percentile
94.7%
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Affected configurations
Node
fontsy_projectfontsyRange≤1.8.6wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| fontsy_project | fontsy | * | cpe:2.3:a:fontsy_project:fontsy:*:*:*:*:*:wordpress:*:* |
Related
wpexploit
wpexploit
Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi
2022-12-21 00:00:00
cve
cve
CVE-2022-4447
2023-01-16 16:15:11
wpvulndb
wpvulndb
Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi
2022-12-21 00:00:00
cvelist
cvelist
CVE-2022-4447 Fontsy <= 1.8.6 - Multiple Unauthenticated SQLi
2023-01-16 15:38:06
prion
prion
Sql injection
2023-01-16 16:15:00
nuclei
nuclei
WordPress Fontsy <=1.8.6 - SQL Injection
2023-01-14 05:54:28
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.088
Percentile
94.7%
Related for NVD:CVE-2022-4447