Threats tagged 'ghsa-9623-4v3q-c8xr'

The Clockinator Lite WordPress plugin versions prior to 1.1.0 contain vulnerabilities that allow unauthenticated users to perform SQL injection attacks. These vulnerabilities stem from insufficient access restrictions on record deletion actions and the use of user-supplied table names in SQL queries without proper validation or escaping. Exploitation can lead to deletion of data from any database table and extraction of sensitive information such as password hashes.