CVE-2022-4157

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before concatenating it to an SQL query in export-votes-all.php. This may allow malicious users with administrator privileges (i.e. on multisite WordPress configurations) to leak sensitive information from the site's database.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-415709.8An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.CVE-2022-415719.8An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.CVE-2022-415729.8An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be ru CVE-2022-415739.8An issue was discovered in Ovidentia 8.3. The file upload feature does not prevent the uploading of executable files. A user can upload a .p CVE-2022-415747.5An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and CVE-2022-415757.5A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to CVE-2022-415767.8The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible program CVE-2022-415777.1The kernel server has a vulnerability of not verifying the length of the data transferred in the user space.Successful exploitation of this CVE-2022-415789.8The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation CVE-2022-415796.5There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof the CVE-2022-41587.5The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST CVE-2022-415809.8The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious