CVE-2021-24943exploração observadaCWE-89

CVE-2021-24943: falha em Registrations for the Events Calendar – Event…

Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL Injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Registrations for the Events Calendar – Event Registration Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

40Vexday Risk Score

Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.

ssvc Actepss 7.3%
da publicação à arma
Publicada no NVD6 de dez.
VulnCheck8 de nov.
The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the rtec_send_unregister_link AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL injection.
Produtos afetados
Unknown · Registrations for the Events Calendar – Event Registration Plugin
CVEs relacionadas — Registrations for the Events Calendar – Event…

No mesmo produto, das mais perigosas para as menos.

CVE-2021-24876—Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site ScriptingEPSS 1.4%CVE-2021-25083—Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site ScriptingEPSS 0.9%