Beveiligingsadvies

CVE-2022-4154

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2022-12-26 12:28:05

Laatst bijgewerkt 2025-04-14 14:18:40

Toegewezen door WPScan

CVSS-score 4.9

Status PUBLISHED

Beschrijving

The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-user.php. This may allow malicious users with at administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.

← Alle CVE's bekijken Bekijk op cve.org ↗