Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbWpvulndbWPVDB-ID:49B25B94-EA1B-4BAD-AED5-9ED561524A3E
HistoryFeb 16, 2022 - 12:00 a.m.

WP Statistics < 13.1.6 - Unauthenticated Blind SQL Injection via IP

2022-02-1600:00:00
wpscan.com
19
wordpress
sql injection
unauthenticated

EPSS

0.31

Percentile

97.0%

JSON

The plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information.

Related

nuclei 1
cvelist 1
nvd 1
cve 1
patchstack 1
prion 1
openvas 1
checkpoint_advisories 1
nuclei
nuclei
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
2023-10-17 07:20:28
cvelist
cvelist
CVE-2022-25149 WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP
2022-02-24 18:27:08
nvd
nvd
CVE-2022-25149
2022-02-24 19:15:10
cve
cve
CVE-2022-25149
2022-02-24 19:15:10
patchstack
patchstack
WordPress WP Statistics plugin <= 13.1.5 - Unauthenticated Blind SQL Injection (SQLi) vulnerability
2022-02-16 00:00:00
prion
prion
Sql injection
2022-02-24 19:15:00
openvas
openvas
WordPress WP Statistics Plugin < 13.1.6 Multiple Vulnerabilities
2022-03-08 00:00:00
checkpoint_advisories
checkpoint_advisories
SQL Servers Time-based SQL Injection (CVE-2011-4710; CVE-2019-13978; CVE-2019-16065; CVE-2019-16119; CVE-2019-16383; CVE-2019-16692; CVE-2020-15468; CVE-2020-26518; CVE-2020-29284; CVE-2021-21915; CVE-2021-21916; CVE-2021-21917; CVE-2022-23337; CVE-2022-25149)
2014-05-26 00:00:00

EPSS

0.31

Percentile

97.0%

JSON
Related for WPVDB-ID:49B25B94-EA1B-4BAD-AED5-9ED561524A3E
nuclei1cvelist1nvd1cve1patchstack1prion1openvas1checkpoint_advisories1