CVE-2014-8810

MEDIUM 6.5 CVSS 2.0

Published: December 24, 2014
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-89
CVSS vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.

Affected products and versions

n/a n/a — Versions not specified
wpsymposiumpro wp_symposium — Up to and including 14.10

References

secunia.com http://secunia.com/advisories/62643
security.szurek.pl http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html Exploit
www.exploit-db.com http://www.exploit-db.com/exploits/35505 Exploit
www.wpsymposium.com http://www.wpsymposium.com/2014/11/release-information-for-v14-11/ Vendor Advisory
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References