Description
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/96781
Exploit x_refsource_misc
http://www.vapidlabs.com/advisory.php?v=183
Third Party Advisory x_refsource_misc
https://wordpress.org/plugins/dtracker/
Scores
CVSS v3
7.5
EPSS
0.0319
EPSS Percentile
86.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-89
Status
published
Products (2)
dtracker_project/dtracker
1.5
ITFlux/DTracker
unspecified - 1.5
Published
Sep 14, 2017
Tracked Since
Feb 18, 2026