CVE-2021-24472

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

9.8

CVSS

56.6%

EPSS (exploit prob.)

99th

EPSS percentile

2021-08-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-918

Affected products

Vendor	Product	Affected versions
qantumthemes	kentharadio	< 2.0.2
qantumthemes	onair2	< 3.9.9.2

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a
https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-24472