2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://wordpress.org/plugins","defaultStatus":"affected","product":"buddybadges","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.0.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:buddybadges_project:buddybadges:*:*:*:*:*:wordpress:*:*","matchCriteriaId":"6DA30D22-6E00-4BCE-8FE9-8F74D98AAB0B","versionEndIncluding":"1.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users"},{"lang":"es","value":"El complemento Buddybadges de WordPress hasta la versión 1.0.0 no sanitiza ni escapa un parámetro antes de usarlo en una declaración SQL, lo que genera una inyección de SQL explotable por usuarios con altos privilegios."}],"id":"CVE-2022-3925","lastModified":"2026-06-17T05:00:35.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-3925","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-04-22T15:08:45.417343Z","version":"2.0.3"}}]},"published":"2022-12-12T18:15:12.037","references":[{"source":"contact@wpscan.com","tags":["Broken Link"],"url":"https://bulletin.iese.de/post/buddybadges_1-0-0/"},{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/178499a3-97d1-4ab2-abbe-4a9d2ebc85da"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"url":"https://bulletin.iese.de/post/buddybadges_1-0-0/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/178499a3-97d1-4ab2-abbe-4a9d2ebc85da"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Modified"}
|