ByteOS Network

Vulnerability Details :

CVE-2021-24138

Assigner-WPScan

Assigner Org ID-1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81

Published At-18 Mar, 2021 | 14:57

Updated At-03 Aug, 2024 | 19:21

AdRotate < 5.8.4 - Authenticated SQL Injection

Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:WPScan

Assigner Org ID:1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81

Published At:18 Mar, 2021 | 14:57

Updated At:03 Aug, 2024 | 19:21

▼CVE Numbering Authority (CNA)

AdRotate < 5.8.4 - Authenticated SQL Injection

Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.

Affected Products

Vendor

Unknown

Product

AdRotate

Versions

Affected

From 5.8.4 before 5.8.4 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-89	CWE-89 SQL Injection

Type: CWE

CWE ID: CWE-89

Description: CWE-89 SQL Injection

Credits

Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)

References

Hyperlink	Resource
https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151	x_refsource_MISC

Hyperlink: https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151	x_refsource_MISC x_transferred

Hyperlink: https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:contact@wpscan.com

Published At:18 Mar, 2021 | 15:15

Updated At:24 Mar, 2021 | 12:27

Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Primary	2.0	5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:P

Type: Primary

Version: 3.1

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

Type: Primary

Version: 2.0

Base score: 5.5

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:S/C:P/I:N/A:P

CPE Matches

ajdg>>adrotate>>Versions before 5.8.4(exclusive)

cpe:2.3:a:ajdg:adrotate:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	nvd@nist.gov
CWE-89	Secondary	contact@wpscan.com

CWE ID: CWE-89

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-89

Type: Secondary

Source: contact@wpscan.com

References

Hyperlink	Source	Resource
https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151	contact@wpscan.com	Exploit Third Party Advisory

Hyperlink: https://wpscan.com/vulnerability/aafac655-3616-4b27-9d0f-1cbc2faf0151

Source: contact@wpscan.com

Resource:

Exploit

Third Party Advisory

Similar CVEs

8Records found

CVE-2019-13570

Matching Score-6

Assigner-MITRE Corporation

View Details

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.2||HIGH

EPSS-0.80% / 73.15%

7 Day CHG~0.00%

Published-23 Jul, 2019 | 16:16

Updated-04 Aug, 2024 | 23:57

The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.

Vendor-ajdg n/a

Product-adrotate n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2021-36299

Matching Score-4

Assigner-Dell

View Details

Matching Score-4

Assigner-Dell

CVSS Score-7.1||HIGH

EPSS-1.92% / 82.58%

7 Day CHG~0.00%

Published-23 Nov, 2021 | 20:00

Updated-16 Sep, 2024 | 23:36

Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.

Vendor-Dell Inc.

Product-emc_idrac9_firmware Integrated Dell Remote Access Controller (iDRAC)

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2023-27610

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 34.56%

7 Day CHG~0.00%

Published-16 Apr, 2023 | 07:41

Updated-10 Jan, 2025 | 18:54

WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection

Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.

Vendor-transbank TransbankDevelopers

Product-transbank_webpay_rest Transbank Webpay REST

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2021-36348

Matching Score-4

Assigner-Dell

View Details

Matching Score-4

Assigner-Dell

CVSS Score-5.9||MEDIUM

EPSS-0.42% / 60.91%

7 Day CHG~0.00%

Published-25 Jan, 2022 | 22:15

Updated-17 Sep, 2024 | 02:21

iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.

Vendor-Dell Inc.

Product-integrated_dell_remote_access_controller_9 integrated_dell_remote_access_controller_9_firmware Integrated Dell Remote Access Controller (iDRAC)

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE ID-CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVE-2020-29437

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-1.27% / 78.63%

7 Day CHG~0.00%

Published-05 Jan, 2021 | 20:30

Updated-04 Aug, 2024 | 16:55

SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.

Vendor-orangehrm n/a

Product-orangehrm n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2020-8435

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.1||HIGH

EPSS-0.86% / 74.18%

7 Day CHG~0.00%

Published-12 Mar, 2020 | 13:32

Updated-04 Aug, 2024 | 09:56

An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.

Vendor-n/a Metagauss Inc.

Product-registrationmagic n/a

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2023-32128

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 34.56%

7 Day CHG~0.00%

Published-20 Dec, 2023 | 16:02

Updated-27 Aug, 2024 | 15:03

WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin <= 2.2.7 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adastra Crypto Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free.This issue affects Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free: from n/a through 2.2.7.

Vendor-adastracrypto Adastra Crypto

Product-cryptocurrency_payment_\&_donation_box Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2023-31092

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.5||MEDIUM

EPSS-0.12% / 31.10%

7 Day CHG~0.00%

Published-20 Dec, 2023 | 16:06

Updated-02 Aug, 2024 | 14:45

WordPress Easy Bet Plugin <= 1.0.2 is vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Foxskav Easy Bet.This issue affects Easy Bet: from n/a through 1.0.2.

Vendor-foxskav Foxskav

Product-easy_bet Easy Bet

CWE ID-CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVE-2021-24138

Credits

AdRotate < 5.8.4 - Authenticated SQL Injection

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs