Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24360

Yes/No Chart < 1.0.12 - Authenticated (contributor+) Blind SQL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Yes/No Chart

  • 1.0.12 to < 1.0.12affected

References