CVE-2021-24848

CVE-2021-24848: Mediamatic < 2.8.1 - Subscriber+ SQL Injection

Vendor Unknown
Product Mediamatic – Media Library Folders
Weakness CWE-89 · SQLi
Published December 13, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection

Key dates

02Disclosure timeline

December 13, 2021 CVE published
August 3, 2024 Record updated