PT-2019-14938 · WordPress · New-Contact-Form-Widget

Rezaduty · Publicado 2019-10-10 · Atualizado 2019-10-10 · CVE-2019-17072

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions new-contact-form-widget plugin version 1.0.9

Description The issue is related to SQL Injection, which occurs via the all-query-page.php file.

Recommendations For version 1.0.9, update to a newer version that contains a fix for this issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-17072

Produtos afetados

New-Contact-Form-Widget

Referências · 4

• https://osv.dev/vulnerability/CVE-2019-17072 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-17072 · Nota de Segurança
• https://wordpress.org/plugins/new-contact-form-widget/#description · Aviso do Fabricante
• https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece · Nota