Skip to content
Sign in
Not rated

CVE-2022-2958 The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL…

Description

The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections

Affected products and versions

Product Affected versions Fixed in
BadgeOS 3.7 earliest → < 3.7.1.3 3.7.1.3

Other CVEs of BadgeOS

The 2 CVEs of BadgeOS →
CVE-2022-0817 The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement… Not rated
Track this CVE