ByteOS Network

NVD Vulnerability Details :

CVE-2021-24341

Analyzed

Source-contact@wpscan.com

Published At-14 Jun, 2021 | 14:15

Updated At-23 Jun, 2021 | 15:17

When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P

CPE Matches

xllentech>>english_islamic_calendar>>Versions before 2.6.8(exclusive)

cpe:2.3:a:xllentech:english_islamic_calendar:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-89	Primary	contact@wpscan.com

References

Hyperlink	Source	Resource
https://codevigilant.com/disclosure/2021/xllentech-english-islamic-calendar/	contact@wpscan.com	Exploit Third Party Advisory
https://wpscan.com/vulnerability/1eba1c73-a19b-4226-afec-d27c48388a04	contact@wpscan.com	Patch Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History