{"id":"CVE-2025-28972","aliases":["EUVD-2025-18521","GHSA-wmj5-wrgg-pwqg"],"status":"published","title":"WordPress WP Employee Attendance System plugin \u003c= 3.5 - SQL Injection Vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through \u003c= 3.5.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00393,"percentile":0.33736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2025-06-17T15:01:40Z","modified":"2026-06-17T09:04:58Z","products":[{"vendor":"suhas surse","product":"wp employee attendance system"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/wp-employee-attendance-system/vulnerability/wordpress-wp-employee-attendance-system-3-5-sql-injection-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-28972"},{"url":"https://patchstack.com/database/wordpress/plugin/wp-employee-attendance-system/vulnerability/wordpress-wp-employee-attendance-system-3-5-sql-injection-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-wmj5-wrgg-pwqg"}],"sources":{"cve":[{"id":"CVE-2025-28972","title":"WordPress WP Employee Attendance System plugin \u003c= 3.5 - SQL Injection Vulnerability","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through \u003c= 3.5.","status":"published","published":"2025-06-17T15:01:40.024Z","modified":"2026-04-28T16:11:52.062Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:49.824855Z"}],"euvd":[{"id":"EUVD-2025-18521","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through \u003c= 3.5.","status":"published","published":"2025-06-17T15:01:40Z","modified":"2026-04-28T16:11:52Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T19:05:48.961442Z"}],"ghsa":[{"id":"GHSA-wmj5-wrgg-pwqg","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System allows Blind SQL Injection. This issue affects WP Employee Attendance System: from n/a through 3.5.","status":"published","published":"2025-06-17T15:31:08Z","modified":"2025-06-17T15:31:16Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:44.519421Z"}],"nvd":[{"id":"CVE-2025-28972","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Suhas Surse WP Employee Attendance System wp-employee-attendance-system allows Blind SQL Injection.This issue affects WP Employee Attendance System: from n/a through \u003c= 3.5.","status":"published","published":"2025-06-17T15:15:41.077Z","modified":"2026-06-17T09:04:58.72Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:13.247441Z"}]}}