Read the docs
TI-2022-02633 Aliases CVE-2022-2840GHSA-v5j7-5w29-28r9

Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

Priority MEDIUM 57CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Why it matters now

EPSS 0.1315 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Zephyr Project Manager (Unknown): 3.2.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownZephyr Project Manager3.2.5 to before 3.2.53.2.5Patch availableCNA
  • Zephyr Project Manager VendorUnknown Affected 3.2.5 to before 3.2.5 Fixed in 3.2.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zephyr-one:zephyr_project_manager:*:*:*:*:*:wordpress:*:*before 3.2.5VulnerableZephyr-one
  • cpe:2.3:a:zephyr-one:zephyr_project_manager:*:*:*:*:*:wordpress:*:* Versions before 3.2.5 Vulnerable ·Zephyr-one

Remediation

  • Fix · CNA Zephyr Project Manager (Unknown) Fixed in 3.2.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2840
  2. 2026-10-03 Alias added: GHSA-v5j7-5w29-28r9

References

Exploit 2

  • TI-2022-03080 Zephyr Project Manager REST Call cross site scripting CVSS 3.1MEDIUM 5.4
  • TI-2024-28974 WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-24988 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-25995 WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-07066 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation CVSS 3.1HIGH 8.1
  • TI-2025-23591 WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences