by Kastro
Paper/Archive/CVE-2022-2840

CVE-2022-2840

Unknown Zephyr Project Manager — Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

EPSS 13%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 96.4.964 × 2019.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Affected

ProductAffectedFixed inSource
Zephyr Project Manager3.2.5 – < 3.2.53.2.5CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53crefpacketstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html