CVE-2005-3844 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 1.2% (pctl 68)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in phpWordPress PHP News and Article Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the (1) poll and (2) category parameters to index.php, and (3) the ctg parameter in an archive action.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 1.23% — more likely to be exploited than 68% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2005-11-26 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| phpwordpress | php news and article manager |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | phpWordPress 3.0 - Multiple SQL Injections | 2005-11-28 |
References
- http://forum.word-press.net/index.php?&showtopic=76&st=0&#entry181
- http://pridels0.blogspot.com/2005/11/phpwordpress-30-sql-inj.html
- http://secunia.com/advisories/17733
- http://www.osvdb.org/21110
- http://www.securityfocus.com/bid/15582
- http://www.vupen.com/english/advisories/2005/2594
- http://forum.word-press.net/index.php?&showtopic=76&st=0&#entry181
- http://pridels0.blogspot.com/2005/11/phpwordpress-30-sql-inj.html
- http://secunia.com/advisories/17733
- http://www.osvdb.org/21110
- http://www.securityfocus.com/bid/15582
- http://www.vupen.com/english/advisories/2005/2594
→ the Explorer · watch your stack · NVD