CVE-2022-1690

{"containers": {"cna": {"affected": [{"product": "Note Press", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "0.1.10", "status": "affected", "version": "0.1.10", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Daniel Krohmer (Fraunhofer IESE)"}, {"lang": "en", "value": "Shi Chen (University of Kaiserslautern)"}], "descriptions": [{"lang": "en", "value": "The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-06T08:51:26.000Z", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d"}, {"tags": ["x_refsource_MISC"], "url": "https://bulletin.iese.de/post/note-press_0-1-10_3"}], "source": {"discovery": "EXTERNAL"}, "title": "Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-1690", "STATE": "PUBLIC", "TITLE": "Note Press <= 0.1.10 - Admin+ SQLi via Bulk Actions"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Note Press", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.1.10", "version_value": "0.1.10"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Daniel Krohmer (Fraunhofer IESE)"}, {"lang": "eng", "value": "Shi Chen (University of Kaiserslautern)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d"}, {"name": "https://bulletin.iese.de/post/note-press_0-1-10_3", "refsource": "MISC", "url": "https://bulletin.iese.de/post/note-press_0-1-10_3"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:03.752Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bulletin.iese.de/post/note-press_0-1-10_3"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-1690", "datePublished": "2022-06-06T08:51:26.000Z", "dateReserved": "2022-05-12T00:00:00.000Z", "dateUpdated": "2024-08-03T00:10:03.752Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Note Press", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "0.1.10", "status": "affected", "version": "0.1.10", "versionType": "custom"}]}], "source": "contact@wpscan.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:datainterlock:note_press:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "F342D75E-EE22-4848-8D5F-457914ADED2E", "versionEndIncluding": "0.1.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection"}, {"lang": "es", "value": "El plugin Note Press de WordPress versiones hasta 0.1.10, no sanea ni escapa los identificadores de las acciones masivas antes de usarlos en una sentencia SQL en una p\u00e1gina de administraci\u00f3n, conllevando a una inyecci\u00f3n SQL"}], "id": "CVE-2022-1690", "lastModified": "2026-06-17T04:22:55.853", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-08T10:15:10.507", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bulletin.iese.de/post/note-press_0-1-10_3"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bulletin.iese.de/post/note-press_0-1-10_3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "contact@wpscan.com", "type": "Secondary"}]}

{}

{}