CVE-2023-0765

Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection

High · published April 17, 2023

CVSS v3.1
8.8
EPSS
1%
Percentile
58.5
In the wild
Unconfirmed
What it is

The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00873 · 58.5th percentile
Published
2023-04-17T12:17Z
EPSS history
Timeline
  • 17 APR 12:17Z
    Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection
    cvelistv5