CVE-2021-24951

State: PUBLISHED · Published: 2021-12-13 · Updated: 2024-08-03 · Assigner: WPScan

Description

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues

CWE

CWE-89 — CWE-89 SQL Injection

Affected

Unknown / LearnPress – WordPress LMS Plugin — v=4.1.4 <4.1.4 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/0a16ddc5-5ab9-4a8f-86b5-41edcbeafc50 x_refsource_MISC

Source

cvelistV5-main/cves/2021/24xxx/CVE-2021-24951.json