CVE-2023-2744

CVE-2023-2744: fallo en WP ERP | Complete HR solution with recruitment…

WP ERP < 1.12.4 - Admin+ SQL Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 2.6%
The ERP WordPress plugin before 1.12.4 does not properly sanitise and escape the `type` parameter in the `erp/v1/accounting/v1/people` REST API endpoint before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
Productos afectados
Unknown · WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
CVEs relacionadas — WP ERP | Complete HR solution with recruitment…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-12812HIGHWP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee InformationEPSS 0.5%CVE-2023-2743MEDIUMWP ERP < 1.12.4 - Reflected Cross-Site ScriptingEPSS 0.5%CVE-2024-12808MEDIUMWP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSSEPSS 0.3%