CVE-2024-5975

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 30, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-59769.8A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been classified as critical. Affected CVE-2024-59775.4The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions CVE-2024-59797.5In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.too CVE-2024-59809.8A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extrac CVE-2024-59819.8A vulnerability was found in itsourcecode Online House Rental System 1.0. It has been classified as critical. Affected is an unknown functio CVE-2024-59829.8A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input h CVE-2024-59839.8A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been declared as critical. Affected by this vulnerability is an unkno CVE-2024-59849.8A vulnerability was found in itsourcecode Online Bookstore 1.0. It has been rated as critical. Affected by this issue is some unknown functi CVE-2024-59858.8A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. This affects an unknown part of the fil CVE-2024-59869.1A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved CVE-2024-59874.3The WP Accessibility Helper (WAH) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check CVE-2024-59889.8Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and