What’s Vulnerable › Vulnerabilities

CVE-2022-3856: Comic Book Management System < 2.2.0 - Admin+ SQLi

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-05 · updated 2026-06-17

Description

The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.

Affected products

• Comic Book Management System: before 2.2.0 — fixed in 2.2.0

How to fix

Upgrade to a fixed version: Comic Book Management System 2.2.0. Check the vendor advisory for mitigations.

References

• https://bulletin.iese.de/post/comicbookmanagementsystemweeklypicks_2-0-0_1/
• https://wpscan.com/vulnerability/c0f5cf61-b3e2-440f-a185-61df360c1192
• https://bulletin.iese.de/post/comicbookmanagementsystemweeklypicks_2-0-0_1/
• https://wpscan.com/vulnerability/c0f5cf61-b3e2-440f-a185-61df360c1192

Get alerted when CVE-2022-3856 or the next vulnerability affects your stack