CVE-2020-36852: Missing Authorization

The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazalesdsdeleteentriestablerow function. This makes it possible for...

CVE-2020-10817

The CVE-2020-10817 entry describes a SQL injection vulnerability in the WordPress plugin “custom-searchable-data-entry-system” (aka Custom Searchable Data Entry System) up to version 1.7.1. The root cause is lack of input validation when constructing or handling SQL statements, enabling an attack...

CVE-2020-10817: Improper Neutralization of Special Elements used in an SQL Command

The custom-searchable-data-entry-system aka Custom Searchable Data Entry System plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued...

PT-2020-12341

Name of the Vulnerable Software and Affected Versions Custom Searchable Data Entry System plugin versions through 1.7.1 Description The issue allows SQL Injection. The product is discontinued. Recommendations For versions through 1.7.1, as the product is discontinued, there is no information abou...

Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Data Modification and Deletion

The estimated 2,000+ sites running the plugin are vulnerable to Unauthenticated Data Modification and Deletion, including the potential to delete the entire contents of any table in a vulnerable site’s database...