CVE-2023-0037 json
10WebMapBuilder < 1.0.73 - Unauthenticated SQLi
published 2023-03-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12142
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.9%
- EPSS 3.9% chance of exploitation in 30 days, percentile 90%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The 10Web Map Builder for Google Maps WordPress plugin before 1.0.73 does not properly sanitise and escape some parameters before using them in an SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
Patch / fix
- Unknown 10Web Map Builder for Google Maps 1.0.73
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction
3.91% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template WordPress 10Web Map Builder < 1.0.73 - Unauthenticated SQL Injection nuclei detection template
- wpscan.com https://wpscan.com/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Unknown 10Web Map Builder for Google Maps
Classification
- Technology feeds
References
-
wpscan.com
/vulnerability/33ab1fe2-6611-4f43-91ba-52c56f02ed56
exploit, vdb-entry, technical-description, third-party-advisory
-
bulletin.iese.de
/post/wd-google-maps_1-0-72_1
broken-link
Sources
- CVE List CVE-2023-0037
- NVD CVE-2023-0037
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.