CVE-2024-27956
critical · 9.9A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.
9.9
CVSS
94.1%
EPSS (exploit prob.)
100th
EPSS percentile
2024-03-21
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| valvepress | automatic | <= 3.92.0 |
Check a specific version with /api/v1/cve/match.
References
- https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin?_s_id=cve
- https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve
- https://patchstack.com/articles/critical-vulnerabilities-patched-in-wordpress-automatic-plugin?_s_id=cve
- https://patchstack.com/database/vulnerability/wp-automatic/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-sql-execution-vulnerability?_s_id=cve
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2024-27956