CVEvulnerability
CVE-2022-2840
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-09-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
Description
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Affected configurations
• zephyr-one zephyr project manager (< 3.2.5)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c Exploit, Patch, Third Party Advisory
- http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c Exploit, Patch, Third Party Advisory