CVE-2021-24748
Email Before Download < 6.8 - Admin+ SQL Injection
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
29 Nov 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using them in SQL statements, leading to authenticated SQL injection issues
Affected products
Unknown · Email Before DownloadWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →