{"id":"CVE-2021-24849","state":"PUBLISHED","title":"WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection","description":"The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections","publishedAt":"2021-12-21T08:45:32.000Z","updatedAt":"2024-08-03T19:42:17.219Z","severity":null,"assigner":"WPScan","products":["Unknown WCFM Marketplace – Best Multivendor Marketplace for WooCommerce"],"affected":[{"vendor":"Unknown","product":"WCFM Marketplace – Best Multivendor Marketplace for WooCommerce","versions":[{"version":"3.4.12","status":"affected","lessThan":"3.4.12","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:48:07.505Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/24xxx/CVE-2021-24849.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-24849","state":"PUBLISHED","datePublished":"2021-12-21T08:45:32.000Z","dateUpdated":"2024-08-03T19:42:17.219Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2021-01-14T00:00:00.000Z"},"containers":{"cna":{"title":"WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection","descriptions":[{"lang":"en","value":"The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections"}],"affected":[{"vendor":"Unknown","product":"WCFM Marketplace – Best Multivendor Marketplace for WooCommerce","versions":[{"version":"3.4.12","status":"affected","lessThan":"3.4.12","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2021-12-21T08:45:32.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"JrXnm"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24849","STATE":"PUBLIC","TITLE":"WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"WCFM Marketplace – Best Multivendor Marketplace for WooCommerce","version":{"version_data":[{"version_affected":"<","version_name":"3.4.12","version_value":"3.4.12"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"JrXnm"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89 SQL Injection"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e","refsource":"MISC","url":"https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/763c08a0-4b2b-4487-b91c-be6cc2b9322e","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:42:17.219Z"}}]}}}