Search
Find a vulnerability
Search criteria
2 vulnerabilities found for badgos by badgeos
CVE-2022-2958 (GCVE-0-2022-2958)
Vulnerability from nvd – Published: 2022-09-19 14:01 – Updated: 2024-08-03 00:52Title
BadgeOS < 3.7.1.3 - Subscriber+ SQLi
Summary
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
Severity
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/8743534f-8ebd-49… | x_refsource_MISC |
Impacted products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:52:59.878Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BadgeOS",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.7.1.3",
"status": "affected",
"version": "3.7.1.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "cydave"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-19T14:01:05.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BadgeOS \u003c 3.7.1.3 - Subscriber+ SQLi",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2958",
"STATE": "PUBLIC",
"TITLE": "BadgeOS \u003c 3.7.1.3 - Subscriber+ SQLi"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BadgeOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "3.7.1.3",
"version_value": "3.7.1.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "cydave"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2958",
"datePublished": "2022-09-19T14:01:05.000Z",
"dateReserved": "2022-08-23T00:00:00.000Z",
"dateUpdated": "2024-08-03T00:52:59.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2958 (GCVE-0-2022-2958)
Vulnerability from cvelistv5 – Published: 2022-09-19 14:01 – Updated: 2024-08-03 00:52Title
BadgeOS < 3.7.1.3 - Subscriber+ SQLi
Summary
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
Severity
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/8743534f-8ebd-49… | x_refsource_MISC |
Impacted products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:52:59.878Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BadgeOS",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.7.1.3",
"status": "affected",
"version": "3.7.1.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "cydave"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-19T14:01:05.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BadgeOS \u003c 3.7.1.3 - Subscriber+ SQLi",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2958",
"STATE": "PUBLIC",
"TITLE": "BadgeOS \u003c 3.7.1.3 - Subscriber+ SQLi"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BadgeOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "3.7.1.3",
"version_value": "3.7.1.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "cydave"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2958",
"datePublished": "2022-09-19T14:01:05.000Z",
"dateReserved": "2022-08-23T00:00:00.000Z",
"dateUpdated": "2024-08-03T00:52:59.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}