https://db.gcve.eu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 22 Jul 2026 23:09:36 +0000 https://db.gcve.eu/sighting/af5b9928-e32e-45f9-a99a-625806244c39/export {"uuid": "af5b9928-e32e-45f9-a99a-625806244c39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24843", "type": "seen", "source": "https://t.me/cibsecurity/36941", "content": "\u203c CVE-2021-24843 \u203c\n\nThe SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-07T18:34:52.000000Z"} {"uuid": "af5b9928-e32e-45f9-a99a-625806244c39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24843", "type": "seen", "source": "https://t.me/cibsecurity/36941", "content": "\u203c CVE-2021-24843 \u203c\n\nThe SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-07T18:34:52.000000Z"} https://db.gcve.eu/sighting/af5b9928-e32e-45f9-a99a-625806244c39/export Mon, 07 Feb 2022 18:34:52 +0000 https://db.gcve.eu/sighting/95007de4-9dd5-468f-8550-5310e29ce33a/export {"uuid": "95007de4-9dd5-468f-8550-5310e29ce33a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24849", "type": "seen", "source": "https://t.me/cibsecurity/34421", "content": "\u203c CVE-2021-24849 \u203c\n\nThe wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T12:29:57.000000Z"} {"uuid": "95007de4-9dd5-468f-8550-5310e29ce33a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24849", "type": "seen", "source": "https://t.me/cibsecurity/34421", "content": "\u203c CVE-2021-24849 \u203c\n\nThe wcfm_ajax_controller AJAX action of the WCFM Marketplace WordPress plugin before 3.4.12, available to unauthenticated and authenticated user, does not properly sanitise multiple parameters before using them in SQL statements, leading to SQL injections\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T12:29:57.000000Z"} https://db.gcve.eu/sighting/95007de4-9dd5-468f-8550-5310e29ce33a/export Tue, 21 Dec 2021 12:29:57 +0000 https://db.gcve.eu/sighting/4b3c5a7b-5aba-4017-9cbb-26b0c8b92f0e/export {"uuid": "4b3c5a7b-5aba-4017-9cbb-26b0c8b92f0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24846", "type": "seen", "source": "https://t.me/cibsecurity/34410", "content": "\u203c CVE-2021-24846 \u203c\n\nThe get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T12:22:13.000000Z"} {"uuid": "4b3c5a7b-5aba-4017-9cbb-26b0c8b92f0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24846", "type": "seen", "source": "https://t.me/cibsecurity/34410", "content": "\u203c CVE-2021-24846 \u203c\n\nThe get_query() function of the Ni WooCommerce Custom Order Status WordPress plugin before 1.9.7, used by the niwoocos_ajax AJAX action, available to all authenticated users, does not properly sanitise the sort parameter before using it in a SQL statement, leading to an SQL injection, exploitable by any authenticated users, such as subscriber\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-21T12:22:13.000000Z"} https://db.gcve.eu/sighting/4b3c5a7b-5aba-4017-9cbb-26b0c8b92f0e/export Tue, 21 Dec 2021 12:22:13 +0000 https://db.gcve.eu/sighting/097d4134-ca8e-4fcd-8e13-eec91ba11613/export {"uuid": "097d4134-ca8e-4fcd-8e13-eec91ba11613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24845", "type": "seen", "source": "https://t.me/cibsecurity/33812", "content": "\u203c CVE-2021-24845 \u203c\n\nThe Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-13T14:24:09.000000Z"} {"uuid": "097d4134-ca8e-4fcd-8e13-eec91ba11613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24845", "type": "seen", "source": "https://t.me/cibsecurity/33812", "content": "\u203c CVE-2021-24845 \u203c\n\nThe Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-13T14:24:09.000000Z"} https://db.gcve.eu/sighting/097d4134-ca8e-4fcd-8e13-eec91ba11613/export Mon, 13 Dec 2021 14:24:09 +0000 https://db.gcve.eu/sighting/52ae8645-9bc3-4c84-b74c-ed4fa723177b/export {"uuid": "52ae8645-9bc3-4c84-b74c-ed4fa723177b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24848", "type": "seen", "source": "https://t.me/cibsecurity/33805", "content": "\u203c CVE-2021-24848 \u203c\n\nThe mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin through 2.7, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-13T14:23:58.000000Z"} {"uuid": "52ae8645-9bc3-4c84-b74c-ed4fa723177b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24848", "type": "seen", "source": "https://t.me/cibsecurity/33805", "content": "\u203c CVE-2021-24848 \u203c\n\nThe mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin through 2.7, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-13T14:23:58.000000Z"} https://db.gcve.eu/sighting/52ae8645-9bc3-4c84-b74c-ed4fa723177b/export Mon, 13 Dec 2021 14:23:58 +0000 https://db.gcve.eu/sighting/69277567-fa10-4bb7-be71-2587a28be620/export {"uuid": "69277567-fa10-4bb7-be71-2587a28be620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24842", "type": "seen", "source": "https://t.me/cibsecurity/33026", "content": "\u203c CVE-2021-24842 \u203c\n\nThe Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-29T12:33:24.000000Z"} {"uuid": "69277567-fa10-4bb7-be71-2587a28be620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24842", "type": "seen", "source": "https://t.me/cibsecurity/33026", "content": "\u203c CVE-2021-24842 \u203c\n\nThe Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-29T12:33:24.000000Z"} https://db.gcve.eu/sighting/69277567-fa10-4bb7-be71-2587a28be620/export Mon, 29 Nov 2021 12:33:24 +0000 https://db.gcve.eu/sighting/fc1138f8-28e1-4a6d-a942-fb1591cc7548/export {"uuid": "fc1138f8-28e1-4a6d-a942-fb1591cc7548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24847", "type": "seen", "source": "https://t.me/cibsecurity/32496", "content": "\u203c CVE-2021-24847 \u203c\n\nThe importFromRedirection AJAX action of the SEO Redirection Plugin \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T16:26:42.000000Z"} {"uuid": "fc1138f8-28e1-4a6d-a942-fb1591cc7548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24847", "type": "seen", "source": "https://t.me/cibsecurity/32496", "content": "\u203c CVE-2021-24847 \u203c\n\nThe importFromRedirection AJAX action of the SEO Redirection Plugin \u00c3\u00a2\u00e2\u201a\u00ac\u00e2\u20ac\u0153 301 Redirect Manager WordPress plugin before 8.2, available to any authenticated user, does not properly sanitise the offset parameter before using it in a SQL statement, leading an SQL injection when the redirection plugin is also installed\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T16:26:42.000000Z"} https://db.gcve.eu/sighting/fc1138f8-28e1-4a6d-a942-fb1591cc7548/export Wed, 17 Nov 2021 16:26:42 +0000 https://db.gcve.eu/sighting/1646d8cb-8482-4883-ae51-c74e58b6f5a6/export {"uuid": "1646d8cb-8482-4883-ae51-c74e58b6f5a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24844", "type": "seen", "source": "https://t.me/cibsecurity/32003", "content": "\u203c CVE-2021-24844 \u203c\n\nThe Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-08T20:29:38.000000Z"} {"uuid": "1646d8cb-8482-4883-ae51-c74e58b6f5a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24844", "type": "seen", "source": "https://t.me/cibsecurity/32003", "content": "\u203c CVE-2021-24844 \u203c\n\nThe Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-08T20:29:38.000000Z"} https://db.gcve.eu/sighting/1646d8cb-8482-4883-ae51-c74e58b6f5a6/export Mon, 08 Nov 2021 20:29:38 +0000 https://db.gcve.eu/sighting/1f771574-0a80-4ffc-902d-2bcfe22ac1c8/export {"uuid": "1f771574-0a80-4ffc-902d-2bcfe22ac1c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24840", "type": "seen", "source": "https://t.me/cibsecurity/31996", "content": "\u203c CVE-2021-24840 \u203c\n\nThe Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-08T20:29:25.000000Z"} {"uuid": "1f771574-0a80-4ffc-902d-2bcfe22ac1c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2021-24840", "type": "seen", "source": "https://t.me/cibsecurity/31996", "content": "\u203c CVE-2021-24840 \u203c\n\nThe Squaretype WordPress theme before 3.0.4 allows unauthenticated users to manipulate the query_vars used to retrieve the posts to display in one of its REST endpoint, without any validation. As a result, private and scheduled posts could be retrieved via a crafted request.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-08T20:29:25.000000Z"} https://db.gcve.eu/sighting/1f771574-0a80-4ffc-902d-2bcfe22ac1c8/export Mon, 08 Nov 2021 20:29:25 +0000