CVE-2022-0949

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-09505.4Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09516.1File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09528.8The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, CVE-2022-09536.1The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outpCVE-2022-09545.4Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments CVE-2022-09554.8Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.CVE-2022-09565.4Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.CVE-2022-09575.4Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09584.8The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site CVE-2022-09596.5A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manuaCVE-2022-09605.4Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.CVE-2022-09615.5The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of