CVE-2021-24385
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Filebird 4.7.3 - Unauthenticated SQL Injection
The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
FileBird – WordPress Media Library Folders & File Manager
- Vendor
- Ninja Team
- Product
- FileBird – WordPress Media Library Folders & File Manager
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 4.7.3 | affected | custom | 4.7.3* | Unavailable | None listed |
| 4.7.4 | affected | custom | 4.7.4 | Unavailable | None listed |