CVE-2021-24889CWE-89

Ninja Forms < 3.6.4 - Admin+ SQL Injection

published November 29, 2021

CVSS
—
EPSS
1%
Percentile
70.6
In the wild
Unconfirmed
What it is

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01317 · 70.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-11-29T08:25Z
EPSS history
Timeline
  • 29 NOV 08:25Z
    Ninja Forms < 3.6.4 - Admin+ SQL Injection
    cvelistv5