CVE-2022-1684
Assigner: WPScan
Published: 2022-06-06T08:51:17
State: PUBLISHED
affected: product: CUBE SLIDER
vendor: Unknown
versions: lessThanOrEqual: 1.2
status: affected
version: 1.2
versionType: custom
credits: value: Daniel Krohmer (Fraunhofer IESE)
value: Shi Chen (University of Kaiserslautern)
descriptions: value: The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
source: discovery: EXTERNAL
title: Cube Slider <= 1.2 - Admin+ SQLi
x_generator: WPScan CVE Generator