CVE-2022-2840CWE-89

CVE-2022-2840: vulnerability in Zephyr Project Manager

Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

Published · Updated

Follow this CVE+ Monitor Zephyr Project Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 13%
from disclosure to weapon17 days
Published on NVDSep 19
1st PoC+17d
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Affected products
Unknown · Zephyr Project Manager
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Zephyr Project Manager

In the same product, most dangerous first.

CVE-2024-6536MEDIUMZephyr Project Manager < 3.3.99 - Editor+ XSSEPSS 0.8%CVE-2022-2839—Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSSEPSS 0.5%