ByteOS Network

NVD Vulnerability Details :

CVE-2023-1730

Modified

Source-contact@wpscan.com

Published At-02 May, 2023 | 08:15

Updated At-30 Jan, 2025 | 15:15

The SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

supportcandy>>supportcandy>>Versions before 3.1.5(exclusive)

cpe:2.3:a:supportcandy:supportcandy:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-89

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7	contact@wpscan.com	Exploit Third Party Advisory
https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory

Hyperlink: https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7

Source: contact@wpscan.com

Resource:

Exploit

Third Party Advisory

Hyperlink: https://wpscan.com/vulnerability/44b51a56-ff05-4d50-9327-fc9bab74d4b7

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History