{"affected":[{"affectedData":[{"product":"Five Minute Webshop","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.3.2","status":"affected","version":"1.3.2","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:five_minute_webshop_project:five_minute_webshop:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"D23E7DAD-EF6C-491B-A624-0DD9A3A71677","versionEndIncluding":"1.3.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"},{"lang":"es","value":"El plugin Five Minute Webshop de WordPress versiones hasta 1.3.2, no comprueba ni escapa del parámetro orderby antes de usarlo en una sentencia SQL por medio de la página de administración Manage Products, conllevando a una inyección SQL"}],"id":"CVE-2022-1685","lastModified":"2026-06-17T04:22:55.370","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-06-08T10:15:10.227","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"},{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"contact@wpscan.com","type":"Secondary"}]}