CVE-2021-24341
Assigner: WPScan
Published: 2021-06-14T13:37:12
State: PUBLISHED
affected: product: Xllentech English Islamic Calendar
vendor: Unknown
versions: lessThan: 2.6.8
status: affected
version: 2.6.8
versionType: custom
credits: value: Syed Sheeraz Ali of Codevigilant
descriptions: value: When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
problemTypes: descriptions: cweId: CWE-89
description: CWE-89 SQL Injection
type: CWE
source: discovery: UNKNOWN
title: Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL Injection
x_generator: WPScan CVE Generator