CVE-2014-9519

High

Published: 05/01/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

An SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.3 in login.php allows remote attackers to execute arbitrary SQL commands via the email parameter.

Risk Assessment

This vulnerability could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update the InfiniteWP Admin Panel to version 2.4.3 or later to mitigate this vulnerability.

Other vulnerabilities in InfiniteWP Admin Panel

See all

CVE-2014-9521High
An unrestricted file upload vulnerability exists in the InfiniteWP Admin Panel before version 2.4.4 in uploadScript.php. This allows remote attackers to execute arbitrary code by uploading a file with a double extension.
CVE-2014-9520High
SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.4 in execute.php allows remote attackers to execute arbitrary SQL commands via the historyID parameter.

Original NVD description (English source)

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter.