notificationx 漏洞

严重CVE-2024-16982024/02/27

NotificationX <= 2.8.2 - SQL Injection

The NotificationX - Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

notificationxPoC 已收录

CVSS9.8EPSS 93.9%

高危2023/10/20

NotificationX < 2.3.12 - SQL Injection

The plugin does not validate and escape the id parameter in its notificationx/v1/notification REST endpoint before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL Injection attacks.

notificationxPoC 已收录

CVSS—

严重CVE-2022-03492022/03/07

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nx_id parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

notificationxPoC 已收录

CVSS9.8EPSS 61.5%

notificationx

关联漏洞

NotificationX <= 2.8.2 - SQL Injection

NotificationX < 2.3.12 - SQL Injection

WordPress NotificationX <2.3.9 - SQL Injection