CVE-2022-4166
Contest Gallery < 19.1.5 - Author+ SQL Injection
- State
- Published
- Severity
- 6.5 Medium
- Published
- Dec 26, 2022
- Updated
- Apr 11, 2025
- Reserved
- Nov 28, 2022
Description
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before concatenating it to an SQL query in 4_activate.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Contest GalleryUnknown |
|
Contest Gallery ProUnknown |
|
References
- https://wpscan.com/vulnerability/6e7de2bb-5f71-4c27-ae79-4f6b2ba7f86fexploitvdb-entrytechnical-description
- https://bulletin.iese.de/post/contest-gallery_19-1-4-1_12
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.