CVE-2021-24791

HIGH NUCLEI

Header Footer Code Manager <1.1.14 - SQL Injection

Title source: llm

Description

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections

Nuclei Templates (1)

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
HIGHVERIFIEDby r3Y3r53

References (1)

Scores

CVSS v3 7.2
EPSS 0.0631
EPSS Percentile 91.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
draftpress/header_footer_code_manager < 1.1.14
Published Nov 08, 2021
Tracked Since Feb 18, 2026