CVE-2022-2839
Zephyr Project Manager < 3.2.55 - Unauthorised AJAX Calls To Stored XSS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Zephyr Project Manager WordPress plugin before 3.2.55 does not have any authorisation as well as CSRF in all its AJAX actions, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
| CWE | CWE-79 CWE-352 |
| Vendor | unknown |
| Product | zephyr project manager |
| Published | Oct 3, 2022 |
| Last Updated | Aug 3, 2024 |
Stay Ahead of the Next One
Get instant alerts for unknown zephyr project manager
Be the first to know when new unknown vulnerabilities affecting unknown zephyr project manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Zephyr Project Manager
3.2.55 < 3.2.55
References
Credits
Rizacan Tufan