CVE-2022-22735CWE-89
Simple Quotation <= 1.3.2 - Subscriber+ SQL injection
published March 14, 2022
What it is
The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lacking escaping of user data when using it in SQL statements, allowing any authenticated users, such as subscriber to perform SQL injection attacks
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.01318 · 70.6th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2022-03-14T14:41Z
EPSS history
Timeline