CVE-2019-14348

CVE-2019-14348 affects BearDev JoomSport WordPress plugin 3.3. The vulnerability is a SQL injection in the joomsport_season/new-yorkers/?action=playerlist sid parameter, allowing an attacker to steal, modify, or delete database information. Affected product/version: WordPress JoomSport plugin 3.3 (

CVE-2022-4050

CVE-2022-4050 affects the WordPress JoomSport plugin prior to 5.2.8. The issue is a SQL injection caused by improper sanitization/escaping of a parameter before it is used in a SQL statement, allowing unauthenticated users to issue arbitrary queries. Documented impacts include potential exposure ...

CVE-2021-24384

CVE-2021-24384 affects the JoomSport WordPress plugin prior to 5.1.8. The vulnerability is a PHP object injection in the joomsport_md_load AJAX action, which unserialises input from the shattr POST parameter. It is accessible to unauthenticated users, and while the plugin itself lacks a gadget ch...

CVE-2024-44031

CVE-2024-44031 corresponds to a WordPress JoomSport plugin vulnerability (versions

CVE-2022-2717

CVE-2022-2717 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more” up to version 5.2.5. The vulnerability is an SQL Injection via the orderby parameter on the joomsport-events-form page, caused by insufficient escaping and an inadequately prepared SQL quer...

CVE-2022-2718

Summary: CVE-2022-2718 affects the WordPress plugin “JoomSport – for Sports: Team & League, Football, Hockey & more.” The vulnerability is an SQL injection in the orderby parameter on the joomsport-page-extrafields page, before/during version 5.2.5. The root cause is insufficient escaping and ina...

CVE-2024-43355

CVE-2024-43355 is a Missing Authorization vulnerability in the WordPress plugin JoomSport (BearDev) for Sports: Team & League. Affects JoomSport versions up to and including 5.3.0; root cause is misconfigured Access Control Security Levels, enabling unauthorized access. CVSSv3.1 base score 8.8 (N...