CVE-2021-24666

Katalog CVE

CVSS 9.8 · Critical EPSS 8,9%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada podlove podcast publisher. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.

Rincian

Terbit di NVD

27 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

8,9% peluang dieksploitasi; lebih tinggi dari 95,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/podlove/podlove-publisher/commit/aa8a343a2e2333b34a422f801adee09b020c6d76 patch · advisory pihak ketiga
• https://wpscan.com/vulnerability/fb4d7988-60ff-4862-96a1-80b1866336fe exploit · patch · advisory pihak ketiga