CVE-2025-2010

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwp_upload_resume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-201007.5Improper access control in the memory controller configurations for some Intel(R) Xeon(R) 6 processor with E-cores may allow a privileged us CVE-2025-201018.4Out-of-bounds read for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable information disclosure or denial CVE-2025-201025.5in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.CVE-2025-201036.5Insufficient resource pool in the core management mechanism for some Intel(R) Processors may allow an authenticated user to potentially enab CVE-2025-201047.3Race condition in some Administrative Tools for some Intel(R) Network Adapters package before version 29.4 may allow an authenticated user t CVE-2025-201058.7Improper input validation in some UEFI firmware SMM module for the Intel(R) reference platforms may allow an escalation of privilege. System CVE-2025-201066.7Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 20 CVE-2025-201086.7Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authent CVE-2025-201097.8Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel(R) Processors may allow an authenticated user to pot CVE-2025-20117.5The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up CVE-2025-201117.4A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone CVE-2025-201125.1A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an authenticated, local attacker