Riskcovery

CVE-2021-24463

Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL Injection

State
Published
Severity
Not scored
Published
Aug 2, 2021
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

The get_sliders() function in the Image Slider by Ays- Responsive Slider and Carousel WordPress plugin before 2.5.0 did not use whitelist or validate the orderby parameter before using it in SQL statements passed to the get_results() DB calls, leading to SQL injection issues in the admin dashboard

Scores

The record has no CVSS score.

Weaknesses

Affected Products

ProductVersions
Image Slider by Ays- Responsive Slider and CarouselAys Pro
  • 2.5.0 to before 2.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.