rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24790 Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Contact Form Advanced Database
Credits: lang: en
value: Quentin VILLAIN (3wsec)
Published: 2021-12-13T10:40:54.000Z
CVE-2021-24791 Header Footer Code Manager < 1.1.14 - Admin+ SQL Injections
The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Header Footer Code Manager
Credits: lang: en
value: bl4derunner
Published: 2021-11-08T17:35:21.000Z
CVE-2021-24792 Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Shiny Buttons – CSS3 Button Generator for WordPress
Credits: lang: en
value: Vishal Mohan
Published: 2021-12-13T10:40:55.000Z
CVE-2021-24793 WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPeMatico RSS Feed Fetcher
Credits: lang: en
value: Huy Nguyen
Published: 2021-11-01T08:46:24.000Z
CVE-2021-24794 Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site Scripting
The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Connections Business Directory
Credits: lang: en
value: Huy Nguyen
Published: 2021-11-01T08:46:26.000Z
CVE-2021-24795 Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF
The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Filter Portfolio Gallery
Credits: lang: en
value: Vishal Mohan
Published: 2021-12-13T10:40:57.000Z
CVE-2021-24796 My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting
The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: My Tickets
Credits: lang: en
value: Abhiyan Chhetri
Published: 2021-11-17T10:15:40.000Z
CVE-2021-24797 Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting
The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Tickera – WordPress Event Ticketing
Credits: lang: en
value: Ajit Bhatta
Published: 2021-12-27T10:33:19.000Z
CVE-2021-24798 WP Header Images < 2.0.1 - Reflected Cross-Site Scripting
The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Header Images
Credits: lang: en
value: apple502j
Published: 2021-11-08T17:35:22.000Z
CVE-2021-24799 Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF
The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Far Future Expiry Header
Credits: lang: en
value: apple502j
Published: 2021-11-01T08:46:27.000Z
CVE-2021-24800 DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: DW Question Answer Pro
Credits: lang: en
value: Brandon Roldan
Published: 2022-04-25T15:50:41.000Z
CVE-2021-24801 WP Survey Plus <= 1.0 - Subscriber+ AJAX Calls
The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: WP Survey Plus
Credits: lang: en
value: Vishal Mohan
Published: 2021-11-08T17:35:23.000Z
CVE-2021-24802 Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF
The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Colorful Categories
Credits: lang: en
value: apple502j
Published: 2021-11-17T10:15:41.000Z
CVE-2021-24803 Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Core Tweaks WP Setup
Credits: lang: en
value: Francesco Carlucci
Published: 2022-02-28T09:06:09.000Z
CVE-2021-24804 Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF
The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Simple JWT Login – Login and Register to WordPress using JWT
Credits: lang: en
value: apple502j
Published: 2021-11-17T10:15:43.000Z
CVE-2021-24805 DW Question & Answer Pro <= 1.3.4 - Multiple CSRF
The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: DW Question Answer Pro
Credits: lang: en
value: Brandon Roldan
Published: 2022-04-25T15:50:43.000Z
CVE-2021-24806 wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Comments – wpDiscuz
Credits: lang: en
value: Brandon Roldan
Published: 2021-11-08T17:35:24.000Z
CVE-2021-24807 Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting
The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Support Board
Credits: lang: en
value: John Jefferson Li
Published: 2021-11-08T17:35:25.000Z
CVE-2021-24808 BP Better Messages < 1.9.9.41 - Reflected Cross-Site Scripting
The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'subject' parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: BP Better Messages
Credits: lang: en
value: Brandon Roldan
Published: 2021-11-01T08:46:29.000Z
CVE-2021-24809 BP Better Messages < 1.9.9.41 - Multiple CSRF
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: BP Better Messages
Credits: lang: en
value: Brandon Roldan
Published: 2021-11-01T08:46:30.000Z
CVE-2021-24810 WP Event Manager < 3.1.23 - Admin+ Stored Cross-Site Scripting
The WP Event Manager WordPress plugin before 3.1.23 does not escape some of its Field Editor settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Event Manager – Easily Build your Calendar of Events!
Credits: lang: en
value: Huy Nguyen
Published: 2022-03-07T08:16:00.000Z
CVE-2021-24811 Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting
The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Shop Page WP
Credits: lang: en
value: Mika
Published: 2021-11-29T08:25:37.000Z
CVE-2021-24812 BetterLinks < 1.2.6 - Admin+ Stored Cross-Site Scripting
The BetterLinks WordPress plugin before 1.2.6 does not sanitise and escape some of imported link fields, which could lead to Stored Cross-Site Scripting issues when an admin import a malicious CSV.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: BetterLinks – Shorten, Track and Manage any URL
Credits: lang: en
value: Huy Nguyen
Published: 2021-11-23T19:16:12.000Z
CVE-2021-24813 Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site Scripting
The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Events Made Easy
Credits: lang: en
value: Huy Nguyen
Published: 2021-11-01T08:46:32.000Z
CVE-2021-24814 WordPress GDPR & CCPA < 1.9.26 - Authenticated Reflected Cross-Site Scripting
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.26, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. If the victim is an administrator with a valid session cookie, full control of the WordPress instance may be taken (AJAX calls and iframe manipulation are possible because the vulnerable endpoint is on the same domain as the admin panel - there is no same-origin restriction).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Ace Candelario (@0xspade)
lang: en
value: Victor Paynat-Sautivet (3DS Outscale SOC)
Published: 2022-02-01T12:21:26.000Z
CVE-2021-24815 Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site Scripting
The Accept Donations with PayPal WordPress plugin before 1.3.2 does not escape the Amount Menu Name field of created Buttons, which could allow a high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Unknown
product: Accept Donations with PayPal
Credits: lang: en
value: dc11
Published: 2021-11-17T10:15:44.000Z
CVE-2021-24816 Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Phoenix Media Rename
Credits: lang: en
value: apple502j
Published: 2021-11-08T17:35:26.000Z
CVE-2021-24817 Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site Scripting
The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Ultimate Nofollow
Credits: lang: en
value: Quentin VILLAIN (3wsec)
Published: 2021-12-13T10:40:58.000Z
CVE-2021-24818 WP Limits <= 1.0 - Plugin's Settings Update via CSRF
The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Wp Limits
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:00.000Z
CVE-2021-24819 Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including posts created by other users such as admins and editors.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Page/Post Content Shortcode
Credits: lang: en
value: Francesco Carlucci
Published: 2021-12-13T10:41:02.000Z
CVE-2021-24820 Cost Calculator <= 1.6 - Authenticated Local File Inclusion
The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's Layout
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Cost Calculator
Credits: lang: en
value: apple502j
Published: 2022-02-28T09:06:10.000Z
CVE-2021-24821 Cost Calculator < 1.6 - Contributor+ Stored Cross-Site Scripting
The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Cost Calculator
Credits: lang: en
value: apple502j
Published: 2022-03-07T08:16:02.000Z
CVE-2021-24822 Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Stylish Cost Calculator
Credits: lang: en
value: apple502j
Published: 2021-11-29T08:25:39.000Z
CVE-2021-24823 Support Board < 3.3.6 - Arbitrary File Deletion via CSRF
The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Support Board
Credits: lang: en
value: Brandon Roldan
Published: 2022-02-28T09:06:12.000Z
CVE-2021-24824 Custom Content Shortcode < 4.0.1 - Unauthorised Arbitrary Post Metadata Access
The [field] shortcode included with the Custom Content Shortcode WordPress plugin before 4.0.1, allows authenticated users with a role as low as contributor, to access arbitrary post metadata. This could lead to sensitive data disclosure, for example when used in combination with WooCommerce, the email address of orders can be retrieved
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: Custom Content Shortcode
Credits: lang: en
value: Francesco Carlucci
Published: 2022-03-07T08:16:03.000Z
CVE-2021-24825 Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI
The Custom Content Shortcode WordPress plugin before 4.0.2 does not validate the data passed to its load shortcode, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to display arbitrary files from the filesystem (such as logs, .htaccess etc), as well as perform Local File Inclusion attacks as PHP files will be executed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when either the unfiltered_html or file_edit is disallowed)
Problem types: cwe_id: CWE-345
description: CWE-345 Insufficient Verification of Data Authenticity
Affected products: vendor: Unknown
product: Custom Content Shortcode
Credits: lang: en
value: Francesco Carlucci
Published: 2022-03-07T08:16:05.000Z
CVE-2021-24826 Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting
The Custom Content Shortcode WordPress plugin before 4.0.2 does not escape custom fields before outputting them, which could allow Contributor+ (v < 4.0.1) or Admin+ (v < 4.0.2) users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Please note that such attack is still possible by admin+ in single site blogs by default (but won't be when the unfiltered_html is disallowed)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom Content Shortcode
Credits: lang: en
value: Francesco Carlucci
Published: 2022-03-07T08:16:06.000Z
CVE-2021-24827 Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Asgaros Forum
Credits: lang: en
value: JrXnm
Published: 2021-11-08T17:35:27.000Z
CVE-2021-24828 Mortgage Calculator / Loan Calculator < 1.5.17 - Contributor+ Stored Cross-Site Scripting
The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Mortgage Calculator / Loan Calculator
Credits: lang: en
value: apple502j
Published: 2022-01-03T12:49:04.000Z
CVE-2021-24829 Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL Injection
The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before using it in a SQL statement, leading to an SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Visitor Traffic Real Time Statistics
Credits: lang: en
value: JrXnm
Published: 2021-11-08T17:35:29.000Z