Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2007-0233
7.5
HIGHCVSS v2
Published
January 13, 2007
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in WordPress.
WordPress/WordPress
GitHubWordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.
GitHubWordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.= 2.0, = 2.0.2, = 2.0.6, = 2.0.1, = 2.0.4, = 0.6.2.1, = 1.2.1, = 0.7, = 0.71, = 0.6.2, = 1.5.1.3, = 1.5.2, = 1.5.1, = 1.5.1.2, = 2.0.5, = 1.2, = 1.2.2, = 1.5, = 2.0.3NVD