Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: beardev Component: Joomsport Clear all filters
TI-2024-29007 CVE-2024-43355 · GHSA-r6v5-p997-qh84

WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability

Priority LOW 38

Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.3.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00423 Published 2024-11-01 No fix listed CWE-862
TI-2022-03716 CVE-2022-4050 · GHSA-jw82-36j2-hqqj

JoomSport < 5.2.8 - Unauthenticated SQLi

Priority HIGH 82

The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0509 Published 2022-12-19 Fixed in 5.2.8
TI-2022-02516 CVE-2022-2718 · GHSA-28xf-m3jq-2wmp

SQL injection in beardev JoomSport – for Sports: Team & League, Football, Hockey & more

Priority LOW 35

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including,…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01521 Published 2022-09-06 No fix listed CWE-89
TI-2022-02515 CVE-2022-2717 · GHSA-228j-wwff-p3j2

SQL injection in beardev JoomSport – for Sports: Team & League, Football, Hockey & more

Priority LOW 35

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including, 5.2.5…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01521 Published 2022-09-06 No fix listed CWE-89
TI-2021-06676 CVE-2021-24384 · GHSA-2mh8-69x2-q9m6

JoomSport < 5.1.8 - Unauthenticated PHP Object Injection

Priority MEDIUM 46

The joomsport_md_load AJAX action of the JoomSport WordPress plugin before 5.1.8, registered for both unauthenticated and unauthenticated users, unserialised user input from the shattr POST parameter, leading to a PHP Ob…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02068 Published 2021-07-06 Fixed in 5.1.8 CWE-502