CVE-2022-2460

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
UnknownWPDating< 7.4.0

References

Timeline

Published
Aug 8, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-246009.8Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statementsCVE-2022-246017.5Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injectionCVE-2022-246029.8Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.CVE-2022-246039.8Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.CVE-2022-246049.8Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.CVE-2022-246059.8Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.CVE-2022-246069.8Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.CVE-2022-246079.8Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.CVE-2022-246086.1Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.CVE-2022-246099.8Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write anCVE-2022-24615.3The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions CVE-2022-246108.6Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, b
CVE-2022-2460: Critical severity, CVSS 9.8 | Vulnix