Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
2 selected

3 records

Vendor: Letsrecover Project Component: Letsrecover Clear all filters
TI-2022-03988 CVE-2022-4355 · GHSA-vc46-cf2x-6638

LetsRecover < 1.2.0 - Admin+ SQLi

Priority HIGH 67

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0097 Published 2023-01-02 Fixed in 1.2.0
TI-2022-03989 CVE-2022-4356 · GHSA-f57w-47w6-wjf7

LetsRecover < 1.2.0 - Admin+ SQLi

Priority HIGH 67

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0097 Published 2023-01-02 Fixed in 1.2.0
TI-2022-03990 CVE-2022-4357 · GHSA-f8pg-xh9p-5mpv

LetsRecover < 1.2.0 - Unauthenticated SQLi

Priority HIGH 82

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01106 Published 2023-01-02 Fixed in 1.2.0