CVE-2022-3925

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Unknown	buddybadges	<= 1.0.0

References

https://bulletin.iese.de/post/buddybadges_1-0-0/Broken Link
https://wpscan.com/vulnerability/178499a3-97d1-4ab2-abbe-4a9d2ebc85daExploit, Third Party Advisory
https://bulletin.iese.de/post/buddybadges_1-0-0/Broken Link
https://wpscan.com/vulnerability/178499a3-97d1-4ab2-abbe-4a9d2ebc85daExploit, Third Party Advisory

Timeline

Published: Dec 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392507.5Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0, an attacker cooper CVE-2022-392517.5Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious home CVE-2022-392527.5matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encryption library. Prio CVE-2022-392535.5Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36 CVE-2022-392546.5matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a users requests a room CVE-2022-392557.5Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a maliciou CVE-2022-392568.0Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute CVE-2022-392577.5Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a maliciou CVE-2022-392588.2mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spo CVE-2022-392595.5jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subje CVE-2022-39266.5The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could all CVE-2022-392608.8Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement