CVE-2022-0434

CVE-2022-0434: Page Views Count < 2.4.15 - Unauthenticated SQL Injection

Vendor Unknown
Product Page View Count
Weakness CWE-89 · SQLi
Published March 7, 2022
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks

Key dates

02Disclosure timeline

March 7, 2022 CVE published
August 2, 2024 Record updated