CVE-2022-0814

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Ubigeo de Perú para Woocommerce WordPress plugin before 3.6.4 does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08157.3Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to g CVE-2022-08179.8The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, l CVE-2022-08186.1The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, CVE-2022-08198.8Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.CVE-2022-08206.1Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.CVE-2022-08216.5Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.CVE-2022-08225.4Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.CVE-2022-08236.2An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the passwor CVE-2022-08248.8Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.CVE-2022-08255.4The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update oth CVE-2022-08269.8The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX CVE-2022-08279.8The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX a