Zephyr Project Manager, 2828c20b753453580db85043a8c7e5961c2591d1

CVE, Research URL: 2828c20b753453580db85043a8c7e5961c2591d1
Home page URL: Security reports for Zephyr Project Manager
Application: Zephyr Project Manager
Published on: Aug 29, 2022
Research Description: Zephyr Project Manager [zephyr-project-manager] < 3.2.5 Zephyr Project Manager <= 3.2.42 - Missing Authorization to Cross-Site Scripting The Zephyr Project Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check and lack of authentication/authorization on its REST endpoints in versions up to, and including, 3.2.42. This makes it possible for unauthenticated attackers to utilize them. Additionally, user input is not properly sanitized leading to Stored Cross-Site Scripting.
Affected versions: max 3.2.5.
Status: vulnerable