Demon Image Annotation
Approved changes feed: RSS · Atom
cpe:2.3:a:demonisblack:demon_image_annotation:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Demonisblack (466ff2b7-befb-5bd4-9a71-bc4f52b1fde1) |
|---|---|
| Product | Demon Image Annotation (483f9010-c94b-5236-9ef9-6695cf76a223) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-40215 |
vulnerable | 2026-06-08 06:09:41.463463 |
WordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL Injection
HIGH (7.6)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection.This issue affects demon image annotation: from n/a through 5.1.
Published: 2023-11-03T23:15:12.400Z
Updated: 2026-04-29T09:51:49.988Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4171 |
vulnerable | 2026-06-08 05:51:36.932866 |
demon image annotation <= 5.0 - Improper Input Restriction Validation
MEDIUM (6.5)
The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin improperly validating the number of characters supplied during an annotation despite there being a setting to limit the number characters input. This means that unauthenticated attackers can bypass the length restrictions and input more characters than allowed via the settings.
Published: 2022-12-13T20:16:52.649Z
Updated: 2026-04-08T17:14:51.553Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2864 |
vulnerable | 2026-06-08 05:43:36.634762 |
Details available
HIGH (8.8)
The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2022-10-28T16:52:09.076Z
Updated: 2025-01-31T18:49:38.968Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.