{"cvss":8.8,"datePublished":"2026-08-02T00:00:00Z","dateUpdated":"2026-08-02T00:00:00Z","description":"WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pid' GET parameter. Attackers can send requests to the /mobile-app/v3/ endpoint with crafted 'pid' values using XOR-based payloads to extract sensitive database information or cause denial of service.","dueDate":"","id":"CVE-2023-54359","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"WordPress adivaha Travel Plugin","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"  Improper Neutralization of Special Elements used in an SQL Command","vendor":"Adivaha"}