Vulnerabilites related to Unknown - Form Vibes
cve-2022-3764
Vulnerability from cvelistv5
Published
2024-01-16 15:50
Modified
2024-08-03 01:20
Severity ?
EPSS score ?
Summary
The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability.
References
▼ | URL | Tags |
---|---|---|
https://wpscan.com/vulnerability/9d49df6b-e2f1-4662-90d2-84c29c3b1cb0/ | exploit, vdb-entry, technical-description |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
Unknown | Form Vibes |
Version: 0 ≤ |
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-03T01:20:58.326Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "exploit", "vdb-entry", "technical-description", "x_transferred", ], url: "https://wpscan.com/vulnerability/9d49df6b-e2f1-4662-90d2-84c29c3b1cb0/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { collectionURL: "https://wordpress.org/plugins", defaultStatus: "unaffected", product: "Form Vibes", vendor: "Unknown", versions: [ { lessThan: "1.4.6", status: "affected", version: "0", versionType: "semver", }, ], }, ], credits: [ { lang: "en", type: "finder", value: "Nguyen Duy Quoc Khanh", }, { lang: "en", type: "coordinator", value: "WPScan", }, ], descriptions: [ { lang: "en", value: "The plugin does not filter the \"delete_entries\" parameter from user requests, leading to an SQL Injection vulnerability.", }, ], problemTypes: [ { descriptions: [ { description: "CWE-89 SQL Injection", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-01-16T15:50:50.054Z", orgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", shortName: "WPScan", }, references: [ { tags: [ "exploit", "vdb-entry", "technical-description", ], url: "https://wpscan.com/vulnerability/9d49df6b-e2f1-4662-90d2-84c29c3b1cb0/", }, ], source: { discovery: "EXTERNAL", }, title: "Form Vibes < 1.4.5 - Admin+ SQLi", x_generator: { engine: "WPScan CVE Generator", }, }, }, cveMetadata: { assignerOrgId: "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", assignerShortName: "WPScan", cveId: "CVE-2022-3764", datePublished: "2024-01-16T15:50:50.054Z", dateReserved: "2022-10-31T09:55:09.206Z", dateUpdated: "2024-08-03T01:20:58.326Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }