CVE-2022-3856

Comic Book Management System < 2.2.0 - Admin+ SQLi

The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.

Affected

Comic Book Management System

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.03% chance of exploitation in the next 30 days, 63rd percentile

Published

2022-12-05

Updated

2025-04-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c0f5cf61-b3e2-440f-a185-61df360c1192

References

• CVE Record
• NVD entry