Non Nss

**Name of the Vulnerable Software and Affected Versions** Taskbuilder – Project Management & Task Management Tool With Kanban Board versions prior to 5.1.0 **Description** Authenticated attackers with subscriber-level access and above can perform SQL Injection through the `wppm proj filter` parameter. The issue occurs because the user-supplied value is processed using `sanitize text field()`, which overwrites a previous `absint()` result, and is then concatenated into a SQL WHERE clause as an unquoted numeric operand using `esc sql()`. This process bypasses parameterization by string-interpolating the value into the `$wpdb->prepare()` format string, allowing attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** Update to a version newer than 5.0.9. Avoid using the `wppm proj filter` parameter until the update is applied.