Lucene search
WPScanCVELIST:CVE-2021-24606HistorySep 20, 2021 - 10:06 a.m.
CVE-2021-24606 Availability Calendar < 1.2.1 - Authenticated SQL Injection
2021-09-2010:06:32
CWE-89
WPScan
www.cve.org
0.001 Low
EPSS
Percentile
37.7%
The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+
CNA Affected
[
{
"product": "Availability Calendar",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.2.1",
"status": "affected",
"version": "1.2.1",
"versionType": "custom"
}
]
}
]Related
wpvulndb
wpvulndb
Availability Calendar < 1.2.1 - Authenticated SQL Injection
2021-08-04 00:00:00
nvd
nvd
CVE-2021-24606
2021-09-20 10:15:08
cve
cve
CVE-2021-24606
2021-09-20 10:15:08
prion
prion
Sql injection
2021-09-20 10:15:00
wpexploit
wpexploit
Availability Calendar < 1.2.1 - Authenticated SQL Injection
2021-08-04 00:00:00