« Volver al listado

CVE-2022-1123

Estado: ModificadaAlta (7.2)—

The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mapsmarker — Leaflet Maps Marker

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1123",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)",
          "versions": [
            {
              "status": "affected",
              "version": "3.12.5",
              "lessThan": "3.12.5",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-29T18:15:08.803",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/03e0d4d5-0184-4a15-b8ac-fdc2010e4812",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/03e0d4d5-0184-4a15-b8ac-fdc2010e4812",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitize some parameters before inserting them into SQL queries. As a result, high privilege users could perform SQL injection attacks."
    },
    {
      "lang": "es",
      "value": "El plugin Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) de WordPress versiones anteriores a 3.12.5, no sanea apropiadamente algunos parámetros antes de insertarlos en las consultas SQL. Como resultado, los usuarios con altos privilegios podrían llevar a cabo ataques de inyección SQL"
    }
  ],
  "lastModified": "2026-06-17T04:21:52.373",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mapsmarker:leaflet_maps_marker:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B831A7CC-F544-497B-8C30-4FA67A707ADE",
              "versionEndExcluding": "3.12.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}