WordPress Daily Prayer Time <2022.03.01 - SQL Injection
WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerability.. It does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action, available to unauthenticated users, leading to SQL injection.
daily_prayer_timePoC 已收录
CVSS9.8EPSS 64.7%