rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24915 Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Unknown
product: Contest Gallery – Photo Contest Plugin for WordPress
Credits: lang: en
value: Tyler Miller
Published: 2021-11-29T08:25:50.000Z
CVE-2021-24916 Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
Problem types: description: CWE-284 Improper Access Control
Affected products: vendor: Unknown
product: Qubely
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2023-08-07T14:31:23.983Z
CVE-2021-24917 WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: WPS Hide Login
Credits: lang: en
value: Daniel Ruf
lang: en
value: Thalakus
Published: 2021-12-06T15:55:30.000Z
CVE-2021-24918 Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS
The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before saving the plugin's setting. As a result, any logged-in user on a vulnerable site could update the settings and store rogue JavaScript on each of its posts and pages.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Unknown
product: Smash Balloon Social Post Feed
Credits: lang: en
value: Marc Montpas
Published: 2021-11-29T08:25:51.000Z
CVE-2021-24919 Wicked Folders < 2.18.10 - Subscriber+ SQL Injection
The Wicked Folders WordPress plugin before 2.8.10 does not sanitise and escape the folder_id parameter before using it in a SQL statement in the wicked_folders_save_sort_order AJAX action, available to any authenticated user. leading to an SQL injection
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-01T12:21:30.000Z
CVE-2021-24920 StatCounter < 2.0.7 - Admin+ Stored Cross-Site Scripting
The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: StatCounter – Free Real Time Visitor Stats
Credits: lang: en
value: Ceylan Bozogullarindan
Published: 2022-02-28T09:06:21.000Z
CVE-2021-24921 Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting
The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced Database Cleaner
Credits: lang: en
value: JrXnm
Published: 2022-02-21T10:45:41.000Z
CVE-2021-24922 Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting
The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Pixel Cat – Conversion Pixel Manager
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:19.000Z
CVE-2021-24923 Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.25 - Reflected XSS
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.25 does not escape the sib-statistics-date parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue
Credits: lang: en
value: JrXnm
Published: 2022-01-24T08:00:55.000Z
CVE-2021-24924 Email Log < 2.4.8 - Reflected Cross-Site Scripting
The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Email Log
Credits: lang: en
value: JrXnm
Published: 2021-12-06T15:55:31.000Z
CVE-2021-24925 Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site Scripting
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the current_month_divider parameter of its mec_list_load_more AJAX call (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Modern Events Calendar Lite
Credits: lang: en
value: Krzysztof Zając
Published: 2021-12-13T10:41:20.000Z
CVE-2021-24926 Domain Check < 1.0.17 - Reflected Cross-Site Scripting
The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Ceylan Bozogullarindan
Published: 2022-02-01T12:21:30.000Z
CVE-2021-24927 My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting
The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: My Calendar
Credits: lang: en
value: Krzysztof Zając
Published: 2021-11-29T08:25:52.000Z
CVE-2021-24928 Rearrange Woocommerce Products < 3.0.8 - Subscriber+ SQL Injection
The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Rearrange Woocommerce Products
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:13.000Z
CVE-2021-24930 Bookly < 20.3.1 - Staff Member Stored Cross-Site Scripting
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name field before outputting it back in a page, which could lead to a Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Online Booking and Scheduling Plugin – Bookly
Credits: lang: en
value: Mesut Cetin
Published: 2021-12-06T15:55:32.000Z
CVE-2021-24931 Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL Injection
The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Secure Copy Content Protection and Content Locking
Credits: lang: en
value: Krzysztof Zając
Published: 2021-12-06T15:55:34.000Z
CVE-2021-24932 Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting
The Auto Featured Image (Auto Post Thumbnail) WordPress plugin before 3.9.3 does not sanitise and escape the post_id parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Auto Featured Image (Auto Post Thumbnail)
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:22.000Z
CVE-2021-24933 Dynamic Widgets <= 1.5.16 - Reflected Cross-Site Scripting
The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated users), leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Dynamic Widgets
Credits: lang: en
value: JrXnm
Published: 2022-02-28T09:06:23.000Z
CVE-2021-24934 Visual CSS Style Editor < 7.5.4 - Reflected Cross-Site Scripting
The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Visual CSS Style Editor
Credits: lang: en
value: JrXnm
Published: 2022-02-01T12:21:31.000Z
CVE-2021-24935 WP Google Fonts < 3.1.5 - Reflected Cross-Site Scripting
The WP Google Fonts WordPress plugin before 3.1.5 does not escape the googlefont_ajax_name and googlefont_ajax_family parameter of the googlefont_action AJAx action (available to any authenticated user) before outputing them in attributes, leading Reflected Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Google Fonts
Credits: lang: en
value: JrXnm
Published: 2021-12-06T15:55:35.000Z
CVE-2021-24936 WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP Extra File Types
Credits: lang: en
value: JrXnm
Published: 2022-01-24T08:00:56.000Z
CVE-2021-24937 Asset CleanUp < 1.3.8.5 - Reflected Cross-Site Scripting
The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Asset CleanUp: Page Speed Booster
Credits: lang: en
value: JrXnm
Published: 2022-02-01T12:21:32.000Z
CVE-2021-24938 WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site Scripting
The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_data AJAX action (available to any authenticated user) before outputting it back in the response, leading to a Reflected cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency
Credits: lang: en
value: JrXnm
Published: 2021-12-06T15:55:37.000Z
CVE-2021-24939 LoginWP < 3.0.0.5 - Reflected Cross-Site Scripting
The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login_url and rul_logout_url parameter before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: LoginWP (Formerly Peter's Login Redirect)
Credits: lang: en
value: JrXnm
Published: 2021-12-06T15:55:38.000Z
CVE-2021-24940 Persian Woocommerce <= 5.8.0 - Reflected Cross-Site Scripting
The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an attribute in the admin dashboard, which could lead to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: ووکامرس فارسی
Credits: lang: en
value: JrXnm
Published: 2022-03-14T14:40:59.000Z
CVE-2021-24941 Icegram < 2.0.5 - Reflected Cross-Site Scripting
The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_message_action_row AJAX action before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram
Credits: lang: en
value: JrXnm
Published: 2021-12-21T08:45:37.000Z
CVE-2021-24942 Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
Problem types: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Menu Item Visibility Control
default_status: affected
Credits: lang: en
value: bl4derunner
lang: en
value: WPScan
Published: 2022-12-26T12:28:21.456Z
CVE-2021-24943 Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Registrations for the Events Calendar – Event Registration Plugin
Credits: lang: en
value: Krzysztof Zając
Published: 2021-12-06T15:55:39.000Z
CVE-2021-24944 Custom Dashboard & Login Page < 7.0 - Admin+ Stored Cross-Site Scripting
The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Custom Dashboard & Login Page – AGCA
Credits: lang: en
value: 0ppr2s
Published: 2022-02-01T12:21:33.000Z
CVE-2021-24945 Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses Disclosure
The Like Button Rating ♥ LikeBtn WordPress plugin before 2.6.38 does not have any authorisation and CSRF checks in the likebtn_export_votes AJAX action, which could allow any authenticated user, such as subscriber, to get a list of email and IP addresses of people who liked content from the blog.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: Like Button Rating ♥ LikeBtn
Credits: lang: en
value: Krzysztof Zając
Published: 2021-12-13T10:41:23.000Z
CVE-2021-24946 Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL Injection
The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Modern Events Calendar Lite
Credits: lang: en
value: Krzysztof Zając
Published: 2021-12-13T10:41:25.000Z
CVE-2021-24947 RVM - Responsive Vector Maps < 6.4.2 - Subscriber+ Arbitrary File Read
The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Unknown
product: RVM – Responsive Vector Maps
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-07T15:47:14.000Z
CVE-2021-24948 The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data Disclosure
The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not validate the qvquery parameter of the tp_get_dl_post_info_ajax AJAX action, which could allow unauthenticated users to retrieve sensitive information, such as private and draft posts
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Unknown
product: The Plus Addons for Elementor - Pro
Credits: lang: en
value: Nicolas Vidal from TEHTRIS
Published: 2022-01-10T15:30:31.000Z
CVE-2021-24949 The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL Injection
The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: The Plus Addons for Elementor - Pro
Credits: lang: en
value: Nicolas Vidal from TEHTRIS
Published: 2022-01-10T15:30:31.000Z
CVE-2021-24950 Insight Core <= 1.0 - Subscriber+ PHP Object Injection & Stored XSS
The Insight Core WordPress plugin through 1.0 does not have any authorisation and CSRF checks in the insight_customizer_options_import (available to any authenticated user), does not validate user input before passing it to unserialize(), nor sanitise and escape it before outputting it in the response. As a result, it could allow users with a role as low as Subscriber to perform PHP Object Injection, as well as Stored Cross-Site Scripting attacks
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Insight Core
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-14T14:41:01.000Z
CVE-2021-24951 LearnPress < 4.1.4 - Admin+ SQL Injection
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: LearnPress – WordPress LMS Plugin
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:26.000Z
CVE-2021-24952 Conversios.io < 4.6.2 - Subscriber+ SQL Injection
The Conversios.io WordPress plugin before 4.6.2 does not sanitise, validate and escape the sync_progressive_data parameter for the tvcajax_product_sync_bantch_wise AJAX action before using it in a SQL statement, allowing any authenticated user to perform SQL injection attacks.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Conversios.io – Google Analytics and Google Shopping plugin for WooCommerce
Credits: lang: en
value: JrXnm
Published: 2022-03-07T08:16:08.000Z
CVE-2021-24953 Advanced iFrame < 2022 - Reflected Cross-Site Scripting
The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the ai_config_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Advanced iFrame
Credits: lang: en
value: JrXnm
Published: 2022-03-07T08:16:09.000Z
CVE-2021-24954 ProfilePress < 3.2.3 - Reflected Cross-Site Scripting
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not sanitise and escape the ppress_cc_data parameter before outputting it back in an attribute of an admin dashboard page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: User Registration, Login Form, User Profile & Membership – ProfilePress (Formerly WP User Avatar)
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:28.000Z
CVE-2021-24955 ProfilePress < 3.2.3 - Reflected Cross-Site Scripting
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the pp_get_forms_by_builder_type AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: User Registration, Login Form, User Profile & Membership – ProfilePress (Formerly WP User Avatar)
Credits: lang: en
value: JrXnm
Published: 2021-12-13T10:41:29.000Z
CVE-2021-24956 Blog2Social < 6.8.7 - Reflected Cross-Site Scripting
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.8.7 does not sanitise and escape the b2sShowByDate parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Blog2Social: Social Media Auto Post & Scheduler
Credits: lang: en
value: JrXnm
Published: 2021-12-21T08:45:39.000Z
CVE-2021-24957 Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection
The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Advanced Page Visit Counter – Advanced WordPress Visit Counter
Credits: lang: en
value: Krzysztof Zając
Published: 2022-04-25T15:50:44.000Z