CVE-2025-4840

CVE-2025-4840 Likes and Dislikes 插件 = 1.0.0 - 未认证 SQL 注入 描述 Likes and Dislikes 插件（WordPress）在所有版本（包括 1.0.0）中存在 SQL 注入漏洞，该漏洞通过 'post' 参数触发，原因是用户提供的参数转义不足且现有 SQL 查询缺乏充分准备。这使得未认证的攻击者能够将额外的 SQL 查询附加到现有查询中，从而从数据库中提取敏感信息。 详情 类型 : 插件 标识 : inprosysmedia-likes-dislikes-post 受影响版本 : 1.0.0 CVSS 分数 : 7.5 CVS...

CVE-2025-5287

CVE-2025-5287 概念验证 针对 WordPress Likes and Dislikes 插件 ≤ 1.0.0 的未认证SQL注入漏洞利用 📖 描述 本Python脚本是 CVE-2025-5287 的概念验证（PoC）利用代码，针对 WordPress Likes and Dislikes 插件 ≤ 1.0.0 中的漏洞。 该漏洞允许未认证的攻击者通过 mylikesdislikesaction AJAX 动作中的 post 参数执行基于时间盲注的SQL注入，可能导致敏感数据泄露或进一步利用。 📌 使用方法 ▶️ 依赖要求： Python 3 requests 库 安装所需库...

WordPress Likes and Dislikes Plugin plugin <= 1.0.0 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Likes and Dislikes versions = 1.0.0...

VulnCheck KEV: CVE-2025-5287

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2025-4840 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-5287 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2025-5287

The CVE-2025-5287 vulnerability affects the WordPress plugin Likes and Dislikes (≤ 1.0.0). Root cause: insufficient escaping / lack of prepared statements in the SQL queries used by the my_likes_dislikes_action/ajax flow, allowing unauthenticated SQL injection via the post parameter. Impact: atta...

PT-2025-23072 · Unknown · Likes/Dislikes Plugin

Name of the Vulnerable Software and Affected Versions: Likes and Dislikes Plugin versions up to, and including, 1.0.0 Description: The issue is related to SQL Injection via the post parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

WordPress Likes and Dislikes 1.0.0 SQL Injection

WordPress Likes and Dislikes plugin versions 1.0.0 and below suffer from an unauthenticated remote SQL injection vulnerability...

WordPress plugin Likes and Dislikes Plugin SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2025-5287: Improper Neutralization of Special Elements used in an SQL Command

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...