Vulnerabilites related to Unknown - BadgeOS
cve-2022-0817
Vulnerability from cvelistv5
Published
2022-05-09 16:50
Modified
2024-08-02 23:40
Severity ?
EPSS score ?
Summary
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T23:40:04.355Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BadgeOS",
"vendor": "Unknown",
"versions": [
{
"lessThanOrEqual": "3.7.0",
"status": "affected",
"version": "3.7.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "cydave"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-09T16:50:34",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BadgeOS \u003c= 3.7.0 - Unauthenticated SQLi",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-0817",
"STATE": "PUBLIC",
"TITLE": "BadgeOS \u003c= 3.7.0 - Unauthenticated SQLi"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BadgeOS",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "3.7.0",
"version_value": "3.7.0"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "cydave"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-0817",
"datePublished": "2022-05-09T16:50:34",
"dateReserved": "2022-03-01T00:00:00",
"dateUpdated": "2024-08-02T23:40:04.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-2958
Vulnerability from cvelistv5
Published
2022-09-19 14:01
Modified
2024-08-03 00:52
Severity ?
EPSS score ?
Summary
The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections
References
| ▼ | URL | Tags |
|---|---|---|
| https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:52:59.878Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "BadgeOS",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.7.1.3",
"status": "affected",
"version": "3.7.1.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "cydave"
}
],
"descriptions": [
{
"lang": "en",
"value": "The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-19T14:01:05",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "BadgeOS \u003c 3.7.1.3 - Subscriber+ SQLi",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2958",
"STATE": "PUBLIC",
"TITLE": "BadgeOS \u003c 3.7.1.3 - Subscriber+ SQLi"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "BadgeOS",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "3.7.1.3",
"version_value": "3.7.1.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "cydave"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2958",
"datePublished": "2022-09-19T14:01:05",
"dateReserved": "2022-08-23T00:00:00",
"dateUpdated": "2024-08-03T00:52:59.878Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}