CVE-2022-0836

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 9, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-08375.4The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to sendCVE-2022-08386.1Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.CVE-2022-08399.8Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.CVE-2022-08404.8The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the image_file field when adding a new social icon, allowing hiCVE-2022-08419.8OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.CVE-2022-08424.9A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated atCVE-2022-08438.8Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugsCVE-2022-08459.8Code Injection in GitHub repository pytorchlightning/pytorch-lightning prior to 1.6.0.CVE-2022-08469.8The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL stateCVE-2022-08477.8A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe CVE-2022-08489.8OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.CVE-2022-08495.5Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.