CVE-2022-0411

    Dashboard / Vulnerabilities / CVE-2022-0411

    CVE-2022-0411

    Published: 28 Feb 2022Last Modified: 24 Oct 2026

    Summary: Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection

    Details: The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection

    References: https://plugins.trac.wordpress.org/changeset/2669226/asgaros-forum, https://wpscan.com/vulnerability/35272197-c973-48ad-8405-538bfbafa172, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0411.json, https://nvd.nist.gov/vuln/detail/CVE-2022-0411

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -849343fe5ccc32b48ae5c47c869d221cf464eb17

    Affected versions

    v1.15.20
    v1.15.19
    v1.15.18
    v1.15.17
    v1.15.16
    v1.15.15
    v1.15.14
    v1.15.13
    v1.15.12
    v1.15.11
    v1.15.10
    v1.15.9
    v1.15.8
    v1.15.7
    v1.15.6
    v1.15.5
    v1.15.4
    v1.15.3
    v1.15.2
    v1.15.1
    v1.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-0411 | CVE-DB