CVE-2022-2958CWE-89
BadgeOS < 3.7.1.3 - Subscriber+ SQLi
published September 19, 2022
What it is
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
The record
Technical detail
- CVSS
- Not scored
- CVSS v4.0
- Not supplied
- EPSS
- 0.01317 · 70.6th percentile
- Weakness
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Published
- 2022-09-19T14:01Z
EPSS history
Timeline