CVE-2021-24345

The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.6 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
WPScanCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
sendit_projectsendit
𝑥
≤ 2.5.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04
https://codevigilant.com/disclosure/2021/wp-plugin-sendit/
https://wpscan.com/vulnerability/02ba4d8b-f4d2-42cd-9fae-b543e112fa04