CVE-2022-0773

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.

9.8

CVSS

43.3%

EPSS (exploit prob.)

99th

EPSS percentile

2022-05-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
documentor_project	documentor	<= 1.5.3

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc
https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-0773