CVE-2021-24341
Xllentech English Islamic Calendar < 2.6.8 - Authenticated SQL Injection
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
14 Jun 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection.
Affected products
Unknown · Xllentech English Islamic CalendarWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →