Skip to main content

Rsvpmaker CVE-2023-29095

HIGH
SQL Injection (CWE-89)
2023-07-10 audit@patchstack.com
SQLi Rsvpmaker Carrcommunications
7.2
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.2 HIGH
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jul 10, 2023 - 16:15 nvd
HIGH 7.2

DescriptionNVD

Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 versions.

AnalysisAI

Auth. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 versions. Affected products include: Carrcommunications Rsvpmaker.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.

More in Rsvpmaker

View all
CVE-2022-1768 CRITICAL POC
9.8 Jun 13

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and param
CVE-2022-1453 CRITICAL POC
9.8 May 10

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parame
CVE-2022-1505 CRITICAL
9.8 May 10

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parame
CVE-2024-50531 CRITICAL
10.0 Nov 04

Unrestricted file upload in the RSVPMaker for Toastmasters WordPress plugin (versions through 6.2.4) allows remote unaut
CVE-2023-25054 CRITICAL
10.0 Dec 29

Improper Control of Generation of Code ('Code Injection') vulnerability in David F. Rated critical severity (CVSS 10.0),
CVE-2019-15646 CRITICAL
9.8 Aug 27

The rsvpmaker plugin before 6.2 for WordPress has SQL injection. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-41652 HIGH
8.2 Nov 03

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Rated hig
CVE-2023-25045 MEDIUM
6.7 Oct 31

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Rated med
CVE-2021-24371 LOW POC
2.7 Aug 02

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) tak
CVE-2023-27616 MEDIUM
6.1 Sep 27

Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
CVE-2023-25047 MEDIUM
5.5 Oct 31

A vulnerability in davidfcarr RSVPMarker rsvpmaker.9.3. Rated medium severity (CVSS 5.5), this vulnerability is remotely
CVE-2023-27617 MEDIUM
4.8 Sep 27

Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2023-29095 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy