{"id":"CVE-2025-14124","aliases":["EUVD-2026-0837","GHSA-jwg6-9jwg-258q"],"status":"published","title":"Team \u003c 5.0.11 - Unauthenticated SQLi","description":"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01665,"percentile":0.76899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2026-01-05T06:00:06Z","modified":"2026-06-17T08:35:22Z","exploits":[{"source":"nuclei","id":"CVE-2025-14124","title":"Team WordPress Plugin (TLP Team) \u003c= 5.0.9 - SQL Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-14124.yaml"},{"source":"pocgithub","id":"hyunchiya/CVE-2025-14124","title":"hyunchiya/CVE-2025-14124","date":"2026-01-09","url":"https://github.com/hyunchiya/CVE-2025-14124"}],"products":[{"vendor":"radiustheme","product":"team"},{"vendor":"unknown","product":"team"}],"references":[{"url":"https://wpscan.com/vulnerability/fdd19027-b70e-45a4-882b-77ab1819af91/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14124"},{"url":"https://wpscan.com/vulnerability/fdd19027-b70e-45a4-882b-77ab1819af91"},{"url":"https://github.com/advisories/GHSA-jwg6-9jwg-258q"}],"sources":{"cve":[{"id":"CVE-2025-14124","title":"Team \u003c 5.0.11 - Unauthenticated SQLi","description":"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.","status":"published","published":"2026-01-05T06:00:06.501Z","modified":"2026-01-05T16:26:42.728Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2026-0837","description":"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.","status":"published","published":"2026-01-05T06:00:06Z","modified":"2026-01-05T16:26:42Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:48:55.889439Z"}],"ghsa":[{"id":"GHSA-jwg6-9jwg-258q","title":"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before...","description":"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.","status":"published","published":"2026-01-05T06:30:28Z","modified":"2026-01-05T18:31:28Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:05:29.894873Z"}],"nvd":[{"id":"CVE-2025-14124","description":"The Team  WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.","status":"published","published":"2026-01-05T06:16:02.923Z","modified":"2026-06-17T08:35:22.013Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:55.613137Z"}]}}