CVE-2022-3142CWE-89

NEX-Forms < 7.9.7 - Authenticated SQLi

published September 19, 2022

CVSS
—
EPSS
15%
Percentile
96.7
In the wild
Unconfirmed
What it is

The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.14650 · 96.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-09-19T00:00Z
EPSS history
Timeline
  • 19 SEP 00:00Z
    NEX-Forms < 7.9.7 - Authenticated SQLi
    cvelistv5