CVE-2022-3241

Build App Online < 1.0.19 - Unauthenticated SQL Injection

9.8 Critical

CVE-2022-3241 is a critical vulnerability (CVSS 9.8) in Hakeemnala Build App Online, published January 2, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 65th percentile. No source names a fixed version.

The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.11%Up 0.2 points since Jan 3, 2023

What each source reports

NVD Score used 9.8

Record: CVE-2022-3241
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

CVE List 9.8

Build App Online < 1.0.19 - Unauthenticated SQL Injection

Record: CVE-2022-3241
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2022-42649 9.8

Record: EUVD-2022-42649
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j7v4-8qwm-q852 9.8

The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some...

Record: GHSA-j7v4-8qwm-q852
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

Affected products

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD