CVE-2021-24506

The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:quantumcloud:slider_hero:*:*:*:*:*:wordpress:*:*

History

26 Aug 2021, 18:58

Type Values Removed Values Added
CPE cpe:2.3:a:quantumcloud:slider_hero:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : unknown
v2 : 6.5
v3 : 8.8
References (MISC) https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0 - (MISC) https://wpscan.com/vulnerability/52c8755c-46b9-4383-8c8d-8816f03456b0 - Exploit, Third Party Advisory

23 Aug 2021, 12:23

Type Values Removed Values Added
New CVE

Information

Published : 2021-08-23 12:15

Updated : 2024-02-04 21:47


NVD link : CVE-2021-24506

Mitre link : CVE-2021-24506

CVE.ORG link : CVE-2021-24506


JSON object : View

Products Affected

quantumcloud

  • slider_hero
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')