CVE-2022-1689 — SQL Injection in Note Press

CWE-89 — SQL Injection3 documents3 sources
Severity
2.7LOWNVD
EPSS
0.2%
top 60.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Datainterlock Note Press
Timeline
PublishedJun 8
Latest updateJun 9

Description

The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-7rmv-9m4v-3v62: The Note Press WordPress plugin through 0↗2022-06-09
▶
CVEList
Note Press <= 0.1.10 - Admin+ SQLi via Update↗2022-06-06
▶
CVE-2022-1689 — SQL Injection in Note Press | cvebase