CVE-2021-24336
FlightLog <= 3.0.2 - Authenticated (editor+) SQL Injection
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
07 Jun 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users
Affected products
Unknown · FlightLogWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →