Description

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" tab.

Remediation

References

CVE-2021-28242

Related Vulnerabilities

WordPress Plugin PixCodes Cross-Site Scripting (2.3.6)

WordPress 4.6.x Multiple Vulnerabilities (4.6 - 4.6.27)

e107 Other Vulnerability (CVE-2005-3521)

WordPress Plugin Esponce QR Code Generator Cross-Site Scripting (1.4)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1509)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-138 CVE-2021-28242