CVE-2023-0220

Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi

High · published February 13, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
60.5
In the wild
Unconfirmed
What it is

The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00937 · 60.5th percentile
Published
2023-02-13T14:32Z
EPSS history
Timeline
  • 13 FEB 14:32Z
    Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi
    cvelistv5