CVE-2022-1453criticalobserved exploitationCWE-89

CVE-2022-1453: critical vulnerability in davidfcarr RSVPMaker

RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection

Published · Updated

Follow this CVE+ Monitor RSVPMaker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

65Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 6.9%
from disclosure to weapon
Published on NVDMay 10
VulnCheck+1421d
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
davidfcarr · RSVPMaker
Related CVEs — davidfcarr RSVPMaker

In the same product, most dangerous first.

CVE-2022-1768CRITICALRSVPMaker <= 9.3.2 - Unauthenticated SQL InjectionEPSS 12.9%CVE-2022-1505CRITICALRSVPMaker <= 9.2.6 - Unauthenticated SQL InjectionEPSS 1.9%