CVE-2021-24557

CVE-2021-24557: M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection

Vendor Unknown
Product M-vSlider
Weakness CWE-89 · SQLi
Published August 23, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.

Key dates

02Disclosure timeline

August 23, 2021 CVE published
August 3, 2024 Record updated