Search criteria
9 vulnerabilities found for side_menu by wow-estore
FKIE_CVE-2021-24580
Vulnerability from fkie_nvd - Published: 2021-08-30 15:15 - Updated: 2024-11-21 05:53
Severity ?
Summary
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
References
| URL | Tags | ||
|---|---|---|---|
| contact@wpscan.com | https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| wow-estore | side_menu | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wow-estore:side_menu:*:*:*:*:lite:wordpress:*:*",
"matchCriteriaId": "3F31EE9C-3C4C-4720-BE37-3DF0C0CEE735",
"versionEndExcluding": "2.2.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue"
},
{
"lang": "es",
"value": "El plugin Side Menu Lite de WordPress versiones anteriores a 2.2.6, no sanea la entrada del usuario desde la p\u00e1gina de la Lista en el panel de administraci\u00f3n antes de usarla en una sentencia SQL, conllevando a un problema de inyecci\u00f3n SQL."
}
],
"id": "CVE-2021-24580",
"lastModified": "2024-11-21T05:53:20.750",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-30T15:15:07.603",
"references": [
{
"source": "contact@wpscan.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
],
"sourceIdentifier": "contact@wpscan.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "contact@wpscan.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2021-24521
Vulnerability from fkie_nvd - Published: 2021-08-09 10:15 - Updated: 2024-11-21 05:53
Severity ?
Summary
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
References
| URL | Tags | ||
|---|---|---|---|
| contact@wpscan.com | https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md | Exploit, Third Party Advisory | |
| contact@wpscan.com | https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| wow-estore | side_menu | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wow-estore:side_menu:*:*:*:*:lite:wordpress:*:*",
"matchCriteriaId": "1D91F389-DA62-493C-BF64-D9DFAC884259",
"versionEndExcluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Side Menu Lite \u2013 add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack."
},
{
"lang": "es",
"value": "El plugin de WordPress Side Menu Lite - add sticky fixed buttons versiones anteriores a 2.2.1, no sanea apropiadamente los valores de entrada del navegador cuando se construye una sentencia SQL. Unos usuarios con el rol de administrador o con permiso para administrar este plugin podr\u00edan llevar a cabo un ataque de inyecci\u00f3n SQL"
}
],
"id": "CVE-2021-24521",
"lastModified": "2024-11-21T05:53:13.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-09T10:15:08.047",
"references": [
{
"source": "contact@wpscan.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
},
{
"source": "contact@wpscan.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
}
],
"sourceIdentifier": "contact@wpscan.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "contact@wpscan.com",
"type": "Secondary"
}
]
}
FKIE_CVE-2021-24348
Vulnerability from fkie_nvd - Published: 2021-06-14 14:15 - Updated: 2024-11-21 05:52
Severity ?
Summary
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
References
| URL | Tags | ||
|---|---|---|---|
| contact@wpscan.com | https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/ | Exploit, Patch, Third Party Advisory | |
| contact@wpscan.com | https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/ | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| wow-estore | side_menu | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wow-estore:side_menu:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7BC77F1B-86E5-42EF-A09B-7293E0C98094",
"versionEndExcluding": "3.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The menu delete functionality of the Side Menu \u2013 add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue"
},
{
"lang": "es",
"value": "La funcionalidad menu delete del plugin Side Menu - add fixed side buttons de WordPress versiones anteriores a 3.1.5, disponible para los usuarios Administradores, toma el par\u00e1metro GET y lo usa en una sentencia SQL sin el saneamiento, comprobaci\u00f3n o escape apropiado, conllevando por lo tanto a un problema de Inyecci\u00f3n SQL"
}
],
"id": "CVE-2021-24348",
"lastModified": "2024-11-21T05:52:53.443",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-14T14:15:08.263",
"references": [
{
"source": "contact@wpscan.com",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
},
{
"source": "contact@wpscan.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
}
],
"sourceIdentifier": "contact@wpscan.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "contact@wpscan.com",
"type": "Secondary"
}
]
}
CVE-2021-24580 (GCVE-0-2021-24580)
Vulnerability from cvelistv5 – Published: 2021-08-30 14:11 – Updated: 2024-08-03 19:35
VLAI?
Title
Side Menu Lite < 2.2.6 - Authenticated SQL Injection
Summary
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
Severity ?
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Side Menu Lite - add sticky fixed buttons |
Affected:
2.2.6 , < 2.2.6
(custom)
|
Credits
pang0lin@webray.com.cn
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:20.253Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Side Menu Lite - add sticky fixed buttons",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.2.6",
"status": "affected",
"version": "2.2.6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "pang0lin@webray.com.cn"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-30T14:11:22",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Side Menu Lite \u003c 2.2.6 - Authenticated SQL Injection",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24580",
"STATE": "PUBLIC",
"TITLE": "Side Menu Lite \u003c 2.2.6 - Authenticated SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Side Menu Lite - add sticky fixed buttons",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.2.6",
"version_value": "2.2.6"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "pang0lin@webray.com.cn"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24580",
"datePublished": "2021-08-30T14:11:22",
"dateReserved": "2021-01-14T00:00:00",
"dateUpdated": "2024-08-03T19:35:20.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24521 (GCVE-0-2021-24521)
Vulnerability from cvelistv5 – Published: 2021-08-09 10:04 – Updated: 2024-08-03 19:35
VLAI?
Title
Side Menu Lite < 2.2.1 - Authenticated SQL Injection
Summary
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
Severity ?
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Side Menu Lite – add sticky fixed buttons |
Affected:
2.2.1 , < 2.2.1
(custom)
|
Credits
pang0lin @webray.com.cn inc
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:19.972Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Side Menu Lite \u2013 add sticky fixed buttons",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.2.1",
"status": "affected",
"version": "2.2.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "pang0lin @webray.com.cn inc"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Side Menu Lite \u2013 add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-09T10:04:14",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Side Menu Lite \u003c 2.2.1 - Authenticated SQL Injection",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24521",
"STATE": "PUBLIC",
"TITLE": "Side Menu Lite \u003c 2.2.1 - Authenticated SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Side Menu Lite \u2013 add sticky fixed buttons",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.2.1",
"version_value": "2.2.1"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "pang0lin @webray.com.cn inc"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Side Menu Lite \u2013 add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"name": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md",
"refsource": "MISC",
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24521",
"datePublished": "2021-08-09T10:04:14",
"dateReserved": "2021-01-14T00:00:00",
"dateUpdated": "2024-08-03T19:35:19.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24348 (GCVE-0-2021-24348)
Vulnerability from cvelistv5 – Published: 2021-06-14 13:37 – Updated: 2024-08-03 19:28
VLAI?
Title
Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection
Summary
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
Severity ?
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Side Menu – add fixed side buttons |
Affected:
3.1.5 , < 3.1.5
(custom)
|
Credits
Shreya Pohekar of Codevigilant Project
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:28:23.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Side Menu \u2013 add fixed side buttons",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.1.5",
"status": "affected",
"version": "3.1.5",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Shreya Pohekar of Codevigilant Project"
}
],
"descriptions": [
{
"lang": "en",
"value": "The menu delete functionality of the Side Menu \u2013 add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-14T13:37:12",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Side Menu \u003c 3.1.5 - Authenticated (admin+) SQL Injection",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24348",
"STATE": "PUBLIC",
"TITLE": "Side Menu \u003c 3.1.5 - Authenticated (admin+) SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Side Menu \u2013 add fixed side buttons",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "3.1.5",
"version_value": "3.1.5"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Shreya Pohekar of Codevigilant Project"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The menu delete functionality of the Side Menu \u2013 add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474",
"refsource": "CONFIRM",
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"name": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/",
"refsource": "MISC",
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24348",
"datePublished": "2021-06-14T13:37:12",
"dateReserved": "2021-01-14T00:00:00",
"dateUpdated": "2024-08-03T19:28:23.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24580 (GCVE-0-2021-24580)
Vulnerability from nvd – Published: 2021-08-30 14:11 – Updated: 2024-08-03 19:35
VLAI?
Title
Side Menu Lite < 2.2.6 - Authenticated SQL Injection
Summary
The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue
Severity ?
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Side Menu Lite - add sticky fixed buttons |
Affected:
2.2.6 , < 2.2.6
(custom)
|
Credits
pang0lin@webray.com.cn
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:20.253Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Side Menu Lite - add sticky fixed buttons",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.2.6",
"status": "affected",
"version": "2.2.6",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "pang0lin@webray.com.cn"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-30T14:11:22",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Side Menu Lite \u003c 2.2.6 - Authenticated SQL Injection",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24580",
"STATE": "PUBLIC",
"TITLE": "Side Menu Lite \u003c 2.2.6 - Authenticated SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Side Menu Lite - add sticky fixed buttons",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.2.6",
"version_value": "2.2.6"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "pang0lin@webray.com.cn"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/2faccd1b-4b1c-4b3e-b917-de2d05e860f8"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24580",
"datePublished": "2021-08-30T14:11:22",
"dateReserved": "2021-01-14T00:00:00",
"dateUpdated": "2024-08-03T19:35:20.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24521 (GCVE-0-2021-24521)
Vulnerability from nvd – Published: 2021-08-09 10:04 – Updated: 2024-08-03 19:35
VLAI?
Title
Side Menu Lite < 2.2.1 - Authenticated SQL Injection
Summary
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
Severity ?
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Side Menu Lite – add sticky fixed buttons |
Affected:
2.2.1 , < 2.2.1
(custom)
|
Credits
pang0lin @webray.com.cn inc
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:35:19.972Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Side Menu Lite \u2013 add sticky fixed buttons",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.2.1",
"status": "affected",
"version": "2.2.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "pang0lin @webray.com.cn inc"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Side Menu Lite \u2013 add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-09T10:04:14",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Side Menu Lite \u003c 2.2.1 - Authenticated SQL Injection",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24521",
"STATE": "PUBLIC",
"TITLE": "Side Menu Lite \u003c 2.2.1 - Authenticated SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Side Menu Lite \u2013 add sticky fixed buttons",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.2.1",
"version_value": "2.2.1"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "pang0lin @webray.com.cn inc"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Side Menu Lite \u2013 add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/eb21ebc5-265c-4378-b2c6-62f6bc2f69cd"
},
{
"name": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md",
"refsource": "MISC",
"url": "https://github.com/pang0lin/CVEproject/blob/main/wordpress_side-menu-lite_sqli.md"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24521",
"datePublished": "2021-08-09T10:04:14",
"dateReserved": "2021-01-14T00:00:00",
"dateUpdated": "2024-08-03T19:35:19.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-24348 (GCVE-0-2021-24348)
Vulnerability from nvd – Published: 2021-06-14 13:37 – Updated: 2024-08-03 19:28
VLAI?
Title
Side Menu < 3.1.5 - Authenticated (admin+) SQL Injection
Summary
The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue
Severity ?
No CVSS data available.
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Side Menu – add fixed side buttons |
Affected:
3.1.5 , < 3.1.5
(custom)
|
Credits
Shreya Pohekar of Codevigilant Project
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:28:23.690Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Side Menu \u2013 add fixed side buttons",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.1.5",
"status": "affected",
"version": "3.1.5",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Shreya Pohekar of Codevigilant Project"
}
],
"descriptions": [
{
"lang": "en",
"value": "The menu delete functionality of the Side Menu \u2013 add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-14T13:37:12",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Side Menu \u003c 3.1.5 - Authenticated (admin+) SQL Injection",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24348",
"STATE": "PUBLIC",
"TITLE": "Side Menu \u003c 3.1.5 - Authenticated (admin+) SQL Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Side Menu \u2013 add fixed side buttons",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "3.1.5",
"version_value": "3.1.5"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Shreya Pohekar of Codevigilant Project"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The menu delete functionality of the Side Menu \u2013 add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474",
"refsource": "CONFIRM",
"url": "https://wpscan.com/vulnerability/e0ca257e-6e78-4611-a9ad-be43d37cf474"
},
{
"name": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/",
"refsource": "MISC",
"url": "https://codevigilant.com/disclosure/2021/wp-plugin-side-menu/"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24348",
"datePublished": "2021-06-14T13:37:12",
"dateReserved": "2021-01-14T00:00:00",
"dateUpdated": "2024-08-03T19:28:23.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}