CVE-2022-0255

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Unknown	Database Backup for WordPress	>= 2.5.1, < 2.5.1

References

https://wpscan.com/vulnerability/684bb06d-864f-4cba-ab0d-f83974d026faExploit, Third Party Advisory
https://wpscan.com/vulnerability/684bb06d-864f-4cba-ab0d-f83974d026faExploit, Third Party Advisory

Timeline

Published: Feb 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-02565.4pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-02575.4pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-02588.8pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command CVE-2022-02605.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.CVE-2022-02617.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.CVE-2022-02626.1Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-02637.8Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.CVE-2022-02645.5A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be ret CVE-2022-02659.8Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.CVE-2022-02666.6Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.CVE-2022-02677.2The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adro CVE-2022-02685.4Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.