Lucene search
HistoryApr 26, 2024 - 5:15 a.m.
CVE-2024-3060
enl newsletter
wordpress
plugin
sql injection
cve-2024-3060
admin+
4.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
7.1 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%
The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks
Related
wpexploit
wpexploit
ENL Newsletter <= 1.0.1 - Admin+ SQL Injection
2024-04-05 00:00:00
wpvulndb
wpvulndb
ENL Newsletter <= 1.0.1 - Admin+ SQL Injection
2024-04-05 00:00:00
cvelist
cvelist
CVE-2024-3060 ENL Newsletter <= 1.0.1 - Admin+ SQL Injection
2024-04-26 05:00:04
cve
cve
CVE-2024-3060
2024-04-26 05:15:50
wordfence
wordfence
4.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
7.1 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%
Related for NVD:CVE-2024-3060