CVE-2022-2840
Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi
CRITICAL 9.8EPSS 13.2%
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- Affected
- Zephyr Project Manager
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 13.15% chance of exploitation in the next 30 days, 96th percentile
- Published
- 2022-09-19
- Updated
- 2024-08-03
Proof-of-concept exploits (2)
- http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-I…
- https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c