Lucene search
PRIOn knowledge basePRION:CVE-2022-4156HistoryDec 26, 2022 - 1:15 p.m.
Cross site request forgery (csrf)
2022-12-2613:15:00
PRIOn knowledge base
www.prio-n.com
3
cross site request forgery
contest gallery
wordpress
sql injection
sensitive information leakage
nvd
0.002 Low
EPSS
Percentile
56.9%
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before concatenating it to an SQL query in ajax-functions-backend.php. This may allow malicious users with at least author privilege to leak sensitive information from the site’s database.
| CPE | Name | Operator | Version |
|---|---|---|---|
| contest_gallery | lt | 19.1.5.1 | |
| contest_gallery | lt | 19.1.5.1 |
Related
cve
cve
CVE-2022-4156
2022-12-26 13:15:12
nvd
nvd
CVE-2022-4156
2022-12-26 13:15:12
cvelist
cvelist
CVE-2022-4156 Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection
2022-12-26 12:28:07
wpexploit
wpexploit
Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection
2022-12-05 00:00:00
wpvulndb
wpvulndb
Contest Gallery < 19.1.5.1 - Unauthenticated SQL Injection
2022-12-05 00:00:00