Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for NEX-Forms – Ultimate Form Builder – Contact forms and much more by Unknown

    CVE-2022-3142 (GCVE-0-2022-3142)

    Vulnerability from nvd – Published: 2022-09-19 00:00 – Updated: 2024-08-03 01:00
    VLAI
    Title
    NEX-Forms < 7.9.7 - Authenticated SQLi
    Summary
    The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Credits
    Elias Hohl
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.258Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.9.7",
              "status": "affected",
              "version": "7.9.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Elias Hohl"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-27T00:00:00.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5"
        },
        {
          "url": "https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328"
        },
        {
          "url": "http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NEX-Forms \u003c 7.9.7 - Authenticated SQLi",
      "x_generator": "WPScan CVE Generator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-3142",
    "datePublished": "2022-09-19T00:00:00.000Z",
    "dateReserved": "2022-09-06T00:00:00.000Z",
    "dateUpdated": "2024-08-03T01:00:10.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2022-3142 (GCVE-0-2022-3142)

    Vulnerability from cvelistv5 – Published: 2022-09-19 00:00 – Updated: 2024-08-03 01:00
    VLAI
    Title
    NEX-Forms < 7.9.7 - Authenticated SQLi
    Summary
    The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Credits
    Elias Hohl
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.258Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "NEX-Forms \u2013 Ultimate Form Builder \u2013 Contact forms and much more",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "7.9.7",
              "status": "affected",
              "version": "7.9.7",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Elias Hohl"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-27T00:00:00.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5"
        },
        {
          "url": "https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328"
        },
        {
          "url": "http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "NEX-Forms \u003c 7.9.7 - Authenticated SQLi",
      "x_generator": "WPScan CVE Generator"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2022-3142",
    "datePublished": "2022-09-19T00:00:00.000Z",
    "dateReserved": "2022-09-06T00:00:00.000Z",
    "dateUpdated": "2024-08-03T01:00:10.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}