CVE-2023-0765
Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.8EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
17 abr 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Gallery by BestWebSoft¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →