by Kastro
Paper/Archive/CVE-2022-2460

CVE-2022-2460

Unknown WPDating — WPDating < 7.4.0 - Multiple Unauthenticated SQLi

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.7.657 × 2013.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users

Affected

ProductAffectedFixed inSource
WPDating< 7.4.07.4.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitwpscan.com/vulnerability/694b6dfd-2424-41b4-8595-b6c305c390db