Back to KEVs

CVE-2022-0760

Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

Basic Information

CVE State
PUBLISHED
Reserved Date
February 24, 2022
Published Date
March 21, 2022
Last Updated
August 02, 2024
Vendor
Unknown
Product
Simple Link Directory
Description
The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Tags
wordpress nuclei_scanner

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score

Score
77.72% (Percentile: 98.93%) as of 2025-06-07

Exploit Status

Exploited in the Wild
Yes (2025-05-10 00:00:00 UTC) Source

References

https://wpscan.com/vulnerability/1c83ed73-ef02-45c0-a9ab-68a3468d2210 https://plugins.trac.wordpress.org/changeset/2684915

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-05-10 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0760.yaml 2025-04-26 00:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel