CVE-2021-24755: vulnerability in myCred – Points, Rewards, Gamification, Ranks…
myCred < 2.3 - Subscriber+ SQL Injection
Published · Updated
25Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendepss 1.4%
from disclosure to weapon
Published on NVDNov 29
VulnCheckNov 1
exploitation probability
1.4%top 29% of all CVEs
observed exploitation
yesVulnCheck
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user
Related CVEs — myCred – Points, Rewards, Gamification, Ranks…
In the same product, most dangerous first.