by Kastro
Paper/Archive/CVE-2022-0773

CVE-2022-0773

Unknown Documentor – Create Product Documentation — Documentor <= 1.5.3 - Unauthenticated SQLi

EPSS 43%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.7.987 × 2019.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.

Affected

ProductAffectedFixed inSource
Documentor – Create Product Documentation1.5.3 – 1.5.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc