CVE-2021-24796

MEDIUM

My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-24796 has a selected CVSS score of 6.1 (medium); EIP currently links 2 curated repository PoCs.

Description

The My Tickets WordPress plugin before 1.8.31 does not properly sanitise and escape the Email field of booked tickets before outputting it in the Payment admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
2

Affected products and versions

1
ProductSourceVersion range

My Tickets

CVE List1.8.31 to < 1.8.31affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2021-24796Curated repository PoCby 0xd3vil127Not analyzed1 file

Python · 1.5 KiB

GitHub
PoC details
GitHubCVE-2021-24796Curated repository PoCby yubsy112Not analyzed1 file

Python · 1.5 KiB

GitHub
PoC details

References

2