CVE-2022-2840

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Score

CVSS 3.1 9.8 Critical

Status

Modified - contact@wpscan.com

Published

2022-09-19

Last modified

2024-08-03

Weaknesses

CWE-89

Affected products

• Zephyr Project Manager (Unknown)
• Zephyr Project Manager (Zephyr-one)

References

• http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html
• https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c