CVE-2024-10499

CWE-89 — SQL Injection3 documents3 sources
Severity
7.2HIGH
EPSS
0.3%
top 44.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown AI EngineMeowapps AI Engine
Timeline
PublishedDec 12

Description

The AI Engine WordPress plugin before 2.6.5 does not sanitize and escape a parameter from one of its RESP API endpoint before using it in a SQL statement, allowing admins to perform SQL injection attacks

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5unknown/ai_engine< 2.6.5
▶NVDmeowapps/ai_engine< 2.6.5

🔴Vulnerability Details

2
GHSA
GHSA-5w62-ppvg-pwpq: The AI Engine WordPress plugin before 2↗2024-12-12
▶
CVEList
AI-Engine < 2.6.5 - Admin+ SQLi↗2024-12-12
▶
CVE-2024-10499 (HIGH CVSS 7.2) | The AI Engine WordPress plugin befo | cvebase.io