Orta CVSS 6.8
CVE-2026-104667: CVE-2026-104667: SQL enjeksiyonu
Açıklama (NVD)
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.
Özet bilgiler
- CVSS v3.1
- 6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - EPSS
- %0,23 (yüzdelik 14)
- CWE
- CWE-89
- Yama
- Yok / bilinmiyor