{"advisories":[{"id":"EUVD-2022-35179","source":"euvd","title":"The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35179"}],"cve":"CVE-2022-2958","epss":{"score":0.01286},"mitre":{"cpes":[],"created":"2022-09-19T14:01:05+00:00","description":"The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2022/2xxx/CVE-2022-2958.json","references":["https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"],"title":"BadgeOS < 3.7.1.3 - Subscriber+ SQLi","updated":"2024-08-03T00:52:59.878000+00:00","vendors":[],"weaknesses":["CWE-89"]},"nvd":{"cpes":["cpe:2.3:a:badgeos:badgos:*:*:*:*:*:wordpress:*:*"],"created":"2022-09-19T14:15:11.050000+00:00","description":"The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2022/CVE-2022-2958.json","references":["https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"],"title":null,"updated":"2026-06-17T04:42:53.160000+00:00","vendors":["badgeos","badgeos$PRODUCT$badgos"],"weaknesses":["CWE-89"]},"opencve":{"changes":[{"created":"2025-07-16T13:45:00+00:00","data":[{"details":{"added":{},"removed":{},"updated":{"epss":{"new":{"score":0.00305},"old":{"score":0.00302}}}},"type":"metrics"}],"id":"e5112ae9-07e6-490c-a203-8a2fa72ccbd0"}],"cpes":{"data":["cpe:2.3:a:badgeos:badgos:*:*:*:*:*:wordpress:*:*"],"providers":["nvd"]},"created":{"data":"2022-09-19T14:01:05+00:00","provider":"mitre"},"description":{"data":"The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.01286},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/8743534f-8ebd-496a-99bc-5052a8bac86a"],"providers":["mitre","nvd"]},"title":{"data":"BadgeOS < 3.7.1.3 - Subscriber+ SQLi","provider":"mitre"},"updated":{"data":"2024-11-21T07:01:59.310000+00:00","provider":"nvd"},"vendors":{"data":["badgeos","badgeos$PRODUCT$badgos"],"providers":["nvd"]},"weaknesses":{"data":["CWE-89"],"providers":["mitre","nvd"]}}}