CVE-2023-6035
EazyDocs < 2.3.4 - Subscriber + SQLi
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
11 Dec 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Affected products
Unknown · EazyDocsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →