CVE-2021-24465CWE-89

Meow Gallery < 4.1.9 - Contributor+ SQL Injection

published October 4, 2021

CVSS
—
EPSS
1%
Percentile
67.1
In the wild
Unconfirmed
What it is

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode (available for users as low as Contributor) before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned values to be manipulated in a way that could lead to data disclosure and arbitrary objects to be deserialized.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01168 · 67.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-10-04T11:20Z
EPSS history
Timeline
  • 04 OCT 11:20Z
    Meow Gallery < 4.1.9 - Contributor+ SQL Injection
    cvelistv5