Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,746

Export CSV
CVE-2021-24340

WP Statistics < 13.0.8 - Unauthenticated SQL Injection

The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones.

CVSS 3.1 · 7.5 High EPSS 29.8% KEV · Not listed
Vendors
Veronalabs
Products
Wp Statistics
CVE-2021-24337

Video Embed <= 1.0 - Authenticated (subscriber+) SQL Injection

The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Video-embed-box Project
Products
Video-embed-box
CVE-2021-24336

FlightLog <= 3.0.2 - Authenticated (editor+) SQL Injection

The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Zavedil
Products
Flightlog
CVE-2021-24321

Bello < 1.6.0 - Unauthenticated Blind SQL Injection

The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues

CVSS 3.1 · 9.8 Critical EPSS 66.6% KEV · Not listed
Vendors
Bold-themes
Products
Bello
CVE-2021-24314

Goto < 2.1 - Unauthenticated Blind SQL Injection

The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Boostifythemes
Products
Goto
CVE-2021-24303

JiangQie Official Website Mini Program < 1.1.1 - Authenticated SQL Injection

The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Jiangqie
Products
Official Website Mini Program
CVE-2021-24295

Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset.

CVSS 3.1 · 7.5 High EPSS 5.6% KEV · Not listed
Vendors
Cleantalk
Products
Spam Protection\, Antispam\, Firewall
CVE-2021-24285

Car Seller - Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection

The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.

CVSS 3.1 · 9.8 Critical EPSS 14.7% KEV · Not listed
Vendors
Cars-seller-auto-classifieds-script Project
Products
Cars-seller-auto-classifieds-script
CVE-2021-24221

Quiz And Survey Master < 7.1.12 - Authenticated SQL injection via shortcode

The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin before 7.1.12 did not sanitise the result_id GET parameter on pages with the [qsm_result] shortcode without id attribute, concatenating it in a SQL statement and leading to an SQL injection. The lowest role allowed to use this shortcode in post or pages being author, such user could gain unauthorised access to the DBMS. If the shortcode (without the id attribute) is embed on a public page or post, then unauthenticated users could exploit the injection.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Expresstech
Products
Quiz And Survey Master
CVE-2021-24200

wpDataTables < 3.4.2 - Blind SQL Injection via length Parameter

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'length' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Tms-outsource
Products
Wpdatatables
CVE-2021-24199

wpDataTables < 3.4.2 - Blind SQL Injection via start Parameter

The wpDataTables – Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user to perform Boolean-based blind SQL Injection in the table list page on the endpoint /wp-admin/admin-ajax.php?action=get_wdtable&table_id=1, on the 'start' HTTP POST parameter. This allows an attacker to access all the data in the database and obtain access to the WordPress application.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Tms-outsource
Products
Wpdatatables
CVE-2021-24186

Tutor LMS < 1.8.3 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id

The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24185

Tutor LMS < 1.7.7 - SQL Injection via tutor_place_rating

The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24183

Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_question_form

The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24182

Tutor LMS < 1.8.3 - SQL Injection via tutor_quiz_builder_get_answers_by_question

The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24181

Tutor LMS < 1.7.7 - SQL Injection via tutor_mark_answer_as_correct

The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2021-24149

Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection

Unvalidated input in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.6, did not sanitise the mec[post_id] POST parameter in the mec_fes_form AJAX action when logged in as an author+, leading to an authenticated SQL Injection issue.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Webnus
Products
Modern Events Calendar Lite
CVE-2021-24143

AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection

Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission, such as author, to perform SQL injections.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Accesspressthemes
Products
Accesspress Social Icons
CVE-2021-24142

301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection

Unvaludated input in the 301 Redirects - Easy Redirect Manager WordPress plugin, versions before 2.51, did not sanitise its "Redirect From" column when importing a CSV file, allowing high privilege users to perform SQL injections.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Webfactoryltd
Products
301 Redirects
CVE-2021-24141

Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection

Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Sigmaplugin
Products
Advanced Database Cleaner