Description
The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
Published: 2024-12-12
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 May 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Meowapps
Meowapps ai Engine
Weaknesses CWE-89
CPEs cpe:2.3:a:meowapps:ai_engine:*:*:*:*:*:wordpress:*:*
Vendors & Products Meowapps
Meowapps ai Engine

Thu, 12 Dec 2024 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 12 Dec 2024 06:15:00 +0000

Type Values Removed Values Added
Description The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks
Title AI-Engine < 2.6.5 - Admin+ SQLi
References

Subscriptions

Meowapps Ai Engine
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2024-12-12T15:17:51.374Z

Reserved: 2024-10-29T17:20:09.964Z

Link: CVE-2024-10499

cve-icon Vulnrichment

Updated: 2024-12-12T15:17:04.810Z

cve-icon NVD

Status : Analyzed

Published: 2024-12-12T06:15:20.337

Modified: 2025-05-17T02:25:50.203

Link: CVE-2024-10499

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses