oss-sec mailing list archives
CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1
From: "Hannes Trunde" <hannes.trunde () gmail com>
Date: Tue, 14 Apr 2015 16:07:10 +0200
Hi, during a research I found 3 SQL injection vulnerabilities in 3 different WordPress plugins and wanted to ask for CVE assignments for them. I've already contacted the WordPress.org team and the plugin authors, who either released updates already or are working on a fix. I've also sent a mail to cve-assign () mitre org asking for instructions on how to get CVE IDs assigned to those 3 vulnerabilities but didn't get a response yet. 1) WP Community Events plugin SQL injection vulnerability Affected version: 1.3.5 (and likely all versions below) Fixed version: 1.4 Plugin URL: https://wordpress.org/plugins/community-events/ Changelog: https://wordpress.org/plugins/community-events/changelog/ 2) WP Tune Library plugin SQL injection vulnerability Affected version: 1.5.4 (and likely all versions below) Fixed version: 1.5.5 Plugin URL: https://wordpress.org/plugins/tune-library/ Changelog: https://wordpress.org/plugins/tune-library/changelog/ 3) WP Symposium plugin SQL injection vulnerability Affected version: 15.1 (and likely all versions below) Fixed version: Not yet available, author is working on a fix Plugin URL: https://wordpress.org/plugins/wp-symposium/ (still disabled by WordPress.org team) If you need any further information please let me know! Thank you very much! Hannes Trunde
Current thread:
- CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1 Hannes Trunde (Apr 14)