CVE-2021-24557 | BDVDB-2026-159306 Detail

M-vSlider

Description#

The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References#

https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef
https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/

Exploit#

No public exploit known

History#

Version 12021-08-23Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.