CVE-2023-2484

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jun 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-248407.2HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with adCVE-2023-248417.2HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote aCVE-2023-248425.3HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to accessCVE-2023-248437.5Transient DOS in Modem while triggering a camping on an 5G cell.CVE-2023-248447.8Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.CVE-2023-248459.8A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,CVE-2023-248477.5Transient DOS in Modem while allocating DSM items.CVE-2023-248487.5Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.CVE-2023-248497.5Information Disclosure in data Modem while parsing an FMTP line in an SDP message.CVE-2023-24854.9An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 befoCVE-2023-248507.8Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.CVE-2023-248517.8Memory Corruption in WLAN HOST while parsing QMI response message from firmware.