CVE-2022-4166

Contest Gallery < 19.1.5 - Author+ SQL Injection

Medium · published December 26, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00879 · 58.4th percentile
Published
2022-12-26T12:28Z
EPSS history
Timeline
  • 26 DEC 12:28Z
    Contest Gallery < 19.1.5 - Author+ SQL Injection
    cvelistv5