Threats tagged 'ghsa-c7qj-47g3-72x8'

The VikRentCar Car Rental Management System plugin for WordPress contains a blind SQL Injection vulnerability in the 'catid' parameter affecting all versions up to and including 1.4.10. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries via a specially crafted block stored through the REST API and triggered by previewing a post. The vulnerability arises from insufficient escaping and lack of proper query preparation, enabling extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.