CVE-2023-6035
Last modified
CVE-2023-6035 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.. EPSS estimates a 0.85% chance of exploitation in the next 30 days.
Description
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Spider-Themes | Eazydocs | < 2.3.4 |
References
- https://wpscan.com/vulnerability/44f5a29a-05f9-40d2-80f2-6fb2bda60d79Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/44f5a29a-05f9-40d2-80f2-6fb2bda60d79Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6035?
How severe is CVE-2023-6035?
How do I fix CVE-2023-6035?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6028A reflected cross-site scripting (XSS) vulnerability exists …6.1
- CVE-2023-6029The EazyDocs WordPress plugin before 2.3.6 does not have aut…7.5
- CVE-2023-6030The LogDash Activity Log WordPress plugin before 1.1.4 hooks…5.4
- CVE-2023-6032 A CWE-22: Improper Limitation of a Pathname to a Restricted…5.3
- CVE-2023-6033Improper neutralization of input in Jira integration configu…5.4
- CVE-2023-6034Rejected reason: Accidental request.
- CVE-2023-6036The Web3 WordPress plugin before 3.0.0 is vulnerable to an a…9.8
- CVE-2023-6037The WP TripAdvisor Review Slider WordPress plugin before 11.…4.8
- CVE-2023-6038A Local File Inclusion (LFI) vulnerability exists in the h2o…7.5
- CVE-2023-6039A use-after-free flaw was found in lan78xx_disconnect in dri…5.5
- CVE-2023-6040An out-of-bounds access vulnerability involving netfilter wa…7.8
- CVE-2023-6042Any unauthenticated user may send e-mail from the site with …7.5
Are you affected by CVE-2023-6035?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST