The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/ | Exploit Third Party Advisory |
Configurations
History
28 May 2025, 00:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Contrive
Contrive cz Loan Management |
|
| References | () https://wpscan.com/vulnerability/68f81943-b007-49c8-be9c-d0405b2ba4cf/ - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:contrive:cz_loan_management:*:*:*:*:*:wordpress:*:* | |
| CWE | CWE-89 |
30 Jul 2024, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-30 06:15
Updated : 2025-05-28 00:42
NVD link : CVE-2024-5975
Mitre link : CVE-2024-5975
JSON object : View
Products Affected
contrive
- cz_loan_management
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')