Threats tagged 'ghsa-gxv8-xvj3-3gm9'

The Web 2.0 Directory plugin for WordPress up to version 2.10.12 is vulnerable to a time-based SQL Injection via the 'w2dc_level_filter' parameter. This vulnerability arises from insufficient escaping and improper handling of user input in an integer context, allowing unauthenticated attackers to inject SQL queries that can extract sensitive database information. The vulnerability exploits the lack of protection against time-based payloads such as SLEEP-based conditionals.