Hacker5preme (Ron Jost) - Security Researcher - Exploit Intelligence Platform

CVE-2021-24862 METASPLOIT HIGH ruby WORKING POC

Wordpress RegistrationMagic task_ids Authenticated SQLi

The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue

CVSS 7.2

View Code

CVE-2021-24931 METASPLOIT CRITICAL ruby WORKING POC

Wordpress Secure Copy Content Protection and Content Locking sccp_id Unauthenticated SQLi

The Secure Copy Content Protection and Content Locking WordPress plugin before 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an SQL injection.

CVSS 9.8

View Code

CVE-2021-24946 METASPLOIT CRITICAL ruby WORKING POC

WordPress Modern Events Calendar SQLi Scanner

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue

CVSS 9.8

View Code