CVE-2017-1002022

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Binny V A	surveys	>= unspecified, < 1.01.8

References

http://www.vapidlabs.com/advisory.php?v=193Exploit, Third Party Advisory
https://wordpress.org/plugins/surveys/Third Party Advisory
https://wpvulndb.com/vulnerabilities/8833Third Party Advisory
http://www.vapidlabs.com/advisory.php?v=193Exploit, Third Party Advisory
https://wordpress.org/plugins/surveys/Third Party Advisory
https://wpvulndb.com/vulnerabilities/8833Third Party Advisory

Timeline

Published: Sep 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10020239.8Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file CVE-2017-10020244.3Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upl CVE-2017-10020257.2Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input vi CVE-2017-10020268.8Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input v CVE-2017-10020279.8Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query CVE-2017-10020289.8Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php CVE-2017-100216.1Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: PIA Search). Supported version CVE-2017-10021006.5Default access permissions for Persistent Volumes (PVs) created by the Kubernetes Azure cloud provider in versions 1.6.0 to 1.6.5 are set to CVE-2017-10021019.6In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with CVE-2017-10021025.6In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projec CVE-2017-10021506.1python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection CVE-2017-10021517.5Pagure 3.3.0 and earlier is vulnerable to loss of confidentially due to improper authorization