CVE-2021-24957CWE-89

Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection

published April 25, 2022

CVSS
—
EPSS
1%
Percentile
71.2
In the wild
Unconfirmed
What it is

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01345 · 71.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-04-25T15:50Z
EPSS history
Timeline
  • 25 APR 15:50Z
    Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection
    cvelistv5