CVE-2024-12015

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

The 'Project Manager' WordPress Plugin is affected by an authenticated SQL injection vulnerability in the 'orderby' parameter in the '/pm/v2/activites' route.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-120169.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Inje CVE-2024-120184.3The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up CVE-2024-120197.1The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of fil CVE-2024-12029.8Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass. This issue affects Octopod: before CVE-2024-120206.1There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could d CVE-2024-120218.5Coverity versions prior to 2024.9.0 are vulnerable to stored cross-site scripting (XSS) in various administrative interfaces. The impact of CVE-2024-120236.5The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to ins CVE-2024-120246.1The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_c CVE-2024-120257.5The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-catego CVE-2024-120264.3The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch CVE-2024-120274.3The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch CVE-2024-120285.3The Friends plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in all