CVE-2021-24285: vulnerability in Car Seller - Auto Classifieds Script
Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
45Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 15%
from disclosure to weapon
Published on NVDMay 14
VulnCheck+983d
The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.
Affected products
Unknown · Car Seller - Auto Classifieds Script