CVE-2021-24957

CVE-2021-24957: Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection

Vendor Unknown
Product Advanced Page Visit Counter – Advanced WordPress Visit Counter
Weakness CWE-89 · SQLi
Published April 25, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection

Key dates

02Disclosure timeline

April 25, 2022 CVE published
August 3, 2024 Record updated