CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in winkm89 teachPress teachpress allows SQL Injection.This issue affects teachPress: from n/a through <= 9.0.11.
Explanation of Vulnerability in Simple Terms
teachPress versions up to 9.0.11 contain a SQL injection vulnerability in database queries. An attacker with low-level user access can craft malicious input to extract sensitive data from the database or disrupt site availability. The vulnerability affects the entire site scope. Update to version 9.0.12 or later.
What an attacker can do
Extract sensitive data from the database or cause the site to become unavailable.
Potential impact on your site
Unauthorized users with basic accounts can read private data or crash the database, affecting all site visitors.
Conditions required to exploit
Attacker must have a low-level user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
