ERA404

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

ERA404 records in CISA KEV

No ERA404 vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Stafflist 2 records MEDIUM

Records

2 records in Stafflist · all components

TI-2022-01427 CVE-2022-1556 · GHSA-5p3w-4cp8-8pc4

StaffList < 3.1.5 - Admin+ SQLi

MEDIUM 61

The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20146 Published 2022-05-30 Fixed in 3.1.5 CWE-89

TI-2024-12787 CVE-2024-13749 · GHSA-j5mc-g8mx-hj7w

StaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

LOW 27

The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00272 Published 2025-02-12 No fix listed CWE-79

Open these records in search →

Critical	1
High	3
Medium	4
Low	0
No CVSS	0