CVE-2021-25037CWE-89

All In One SEO < 4.1.5.3 - Authenticated SQL Injection

published January 17, 2022

CVSS
—
EPSS
1%
Percentile
70.0
In the wild
Unconfirmed
What it is

The All in One SEO WordPress plugin before 4.1.5.3 is affected by an authenticated SQL injection issue, which was discovered during an internal audit by the Jetpack Scan team, and could grant attackers access to privileged information from the affected site’s database (e.g., usernames and hashed passwords).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01291 · 70.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-01-17T13:00Z
EPSS history
Timeline
  • 17 JAN 13:00Z
    All In One SEO < 4.1.5.3 - Authenticated SQL Injection
    cvelistv5