Lucene search
Elias HohlWPVDB-ID:8ACC0FC6-EFE6-4662-B9AC-6342A7823328HistoryAug 01, 2022 - 12:00 a.m.
NEX-Forms < 7.9.7 - Authenticated SQLi
2022-08-0100:00:00
Elias Hohl
wpscan.com
8
0.004 Low
EPSS
Percentile
73.0%
The plugin does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
PoC
| CPE | Name | Operator | Version |
|---|---|---|---|
| nex-forms-express-wp-form-builder | lt | 7.9.7 |
Related
prion
prion
Sql injection
2022-09-19 14:15:00
packetstorm
packetstorm
WordPress NEX-Forms SQL Injection
2023-03-27 00:00:00
nuclei
nuclei
NEX-Forms Plugin < 7.9.7 - SQL Injection
2023-10-17 07:20:28
cvelist
cvelist
CVE-2022-3142 NEX-Forms < 7.9.7 - Authenticated SQLi
2022-09-19 00:00:00
patchstack
patchstack
zdt
zdt
cve
cve
CVE-2022-3142
2022-09-19 14:15:11
wpexploit
wpexploit
NEX-Forms < 7.9.7 - Authenticated SQLi
2022-08-01 00:00:00
nvd
nvd
CVE-2022-3142
2022-09-19 14:15:11
exploitdb
exploitdb
NEX-Forms WordPress plugin < 7.9.7 - Authenticated SQLi
2023-03-25 00:00:00