Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for m-vslider by nimble3

    CVE-2021-24557 (GCVE-0-2021-24557)

    Vulnerability from nvd – Published: 2021-08-23 11:10 – Updated: 2024-08-03 19:35
    VLAI
    Title
    M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection
    Summary
    The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Unknown M-vSlider Affected: 2.1.3 , ≤ 2.1.3 (custom)
    		Create a notification for this product.
    Credits
    Shreya Pohekar of Codevigilant Project
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:35:20.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "M-vSlider",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "2.1.3",
              "status": "affected",
              "version": "2.1.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shreya Pohekar of Codevigilant Project"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-23T11:10:11.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "M-vSlider \u003c= 2.1.3 - Authenticated (admin+) SQL Injection",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24557",
          "STATE": "PUBLIC",
          "TITLE": "M-vSlider \u003c= 2.1.3 - Authenticated (admin+) SQL Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "M-vSlider",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2.1.3",
                            "version_value": "2.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Shreya Pohekar of Codevigilant Project"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef"
            },
            {
              "name": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/",
              "refsource": "MISC",
              "url": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24557",
    "datePublished": "2021-08-23T11:10:11.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:35:20.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2021-24557 (GCVE-0-2021-24557)

    Vulnerability from cvelistv5 – Published: 2021-08-23 11:10 – Updated: 2024-08-03 19:35
    VLAI
    Title
    M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection
    Summary
    The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Unknown M-vSlider Affected: 2.1.3 , ≤ 2.1.3 (custom)
    		Create a notification for this product.
    Credits
    Shreya Pohekar of Codevigilant Project
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:35:20.133Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "M-vSlider",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThanOrEqual": "2.1.3",
              "status": "affected",
              "version": "2.1.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shreya Pohekar of Codevigilant Project"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-23T11:10:11.000Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "M-vSlider \u003c= 2.1.3 - Authenticated (admin+) SQL Injection",
      "x_generator": "WPScan CVE Generator",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "contact@wpscan.com",
          "ID": "CVE-2021-24557",
          "STATE": "PUBLIC",
          "TITLE": "M-vSlider \u003c= 2.1.3 - Authenticated (admin+) SQL Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "M-vSlider",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c=",
                            "version_name": "2.1.3",
                            "version_value": "2.1.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Unknown"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Shreya Pohekar of Codevigilant Project"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role."
            }
          ]
        },
        "generator": "WPScan CVE Generator",
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef",
              "refsource": "MISC",
              "url": "https://wpscan.com/vulnerability/8b8e41e8-5a40-4062-b5b7-3b01b1a709ef"
            },
            {
              "name": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/",
              "refsource": "MISC",
              "url": "https://codevigilant.com/disclosure/2021/wp-plugin-m-vslider/"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2021-24557",
    "datePublished": "2021-08-23T11:10:11.000Z",
    "dateReserved": "2021-01-14T00:00:00.000Z",
    "dateUpdated": "2024-08-03T19:35:20.133Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}