QwikSec

Security Database

CVE

CWE

Training

CVE-2021-24915

Published: Nov 29, 2021

Modified: Aug 3, 2024

PUBLISHED

Description

The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before using it in a SQL statement when exporting users from a gallery, which could allow unauthenticated to perform SQL injections attacks, as well as get the list of all users registered on the blog, including their username and email address

Vendor	Product	Versions
Unknown	Contest Gallery – Photo Contest Plugin for WordPress	affected `13.1.0.6 - < 13.1.0.6`

Weaknesses (CWE)

References

https://wpscan.com/vulnerability/45ee86a7-1497-4c81-98b8-9a8e5b3d4fac

x_refsource_MISC

https://gist.github.com/tpmiller87/6c05596fe27dd6f69f1aaba4cbb9c917

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.