CVE-2021-24791

HIGH NUCLEI

Header Footer Code Manager <1.1.14 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-24791 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the "orderby" and "order" request parameters before using them in a SQL statement when viewing the Snippets admin dashboard, leading to SQL injections

Nuclei Templates (1)

Header Footer Code Manager < 1.1.14 - Admin+ SQL Injection
HIGHVERIFIEDby r3Y3r53

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/d55caa9b-d50f-4c13-bc69-dc475641735f

Scores

CVSS v3 7.2
EPSS 0.0503
EPSS Percentile 91.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
draftpress/header_footer_code_manager < 1.1.14
Published Nov 08, 2021
Tracked Since Feb 18, 2026