Aller au contenu
Se connecter
4.1 Moyenne

CVE-2026-14238 The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body…

Description

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

Produits et versions touchés

Produit Versions touchées Corrigé en
Vitepos 3.6 premières → < 3.6.0 3.6.0

Autres CVE de Vitepos

Les 3 CVE de Vitepos →
CVE-2026-14237 The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target… 7.2 Élevée CVE-2026-8157 The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new… 8.8 Élevée
Suivre cette CVE