CVE-2021-24943explotación observadaCWE-89

CVE-2021-24943: fallo en Registrations for the Events Calendar – Event…

Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Registrations for the Events Calendar – Event Registration Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

40Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actepss 7.3%
de la publicación al arma
Publicada en NVD6 dic
VulnCheck8 nov
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Productos afectados
Unknown · Registrations for the Events Calendar – Event Registration Plugin
CVEs relacionadas — Registrations for the Events Calendar – Event…

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-24876—Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2021-25083—Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site ScriptingEPSS 0.9%