CVE-2020-36852: Missing Authorization

The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazalesdsdeleteentriestablerow function. This makes it possible for...

CVE-2020-10817

The CVE-2020-10817 entry describes a SQL injection vulnerability in the WordPress plugin “custom-searchable-data-entry-system” (aka Custom Searchable Data Entry System) up to version 1.7.1. The root cause is lack of input validation when constructing or handling SQL statements, enabling an attack...

CVE-2020-10817: Improper Neutralization of Special Elements used in an SQL Command

The custom-searchable-data-entry-system aka Custom Searchable Data Entry System plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued...

Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Data Modification and Deletion

The estimated 2,000+ sites running the plugin are vulnerable to Unauthenticated Data Modification and Deletion, including the potential to delete the entire contents of any table in a vulnerable site’s database...