Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24777

Hotscot Contact Form < 1.3 - Admin+ SQL Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The view submission functionality in the Hotscot Contact Form WordPress plugin before 1.3 makes a get request with the sub_id parameter which not sanitised, escaped or validated before inserting to a SQL statement, leading to an SQL injection.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Hotscot Contact Form

  • 1.3 to < 1.3affected

References