CVE-2022-0785

PoC —

CVSS 3.1

9.8 critical

EPSS

9%p95

Published

Apr 18, 2022 (Apr 18, 2022)

Modified

Jun 17, 2026

Description

The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection

Vendors: daily prayer time project
Products: daily prayer time
Ecosystems: WordPress
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (9.0%)

In the news0 stories

No ingested article mentions this CVE yet.