Threats tagged 'ghsa-gf37-757h-m7hx'

The JoomSport plugin for WordPress (up to and including version 5.7.14) contains a SQL Injection vulnerability via the 'pgroup' parameter. This flaw allows authenticated users with contributor-level access or higher to inject additional SQL queries by exploiting insufficient escaping and preparation of the SQL statement. The vulnerability can be triggered by embedding a malicious 'pgroup' value in the [jsMatchPlayerList] shortcode within a post preview, enabling extraction of sensitive database information.