← Back to browse · API

CVE-2024-6924

Severity
CRITICAL
CVSS
9.8
EPSS
0.03292
Risk score
40.35
CISA KEV
No
PoC
No
Published
2024-09-08
Modified
2024-09-09
First seen
2026-08-07
Aliases
EUVD-2024-47910, GHSA-XWHW-83C9-38CF
Products
themetechmount:TrueBooker 0 <1.0.3
Sources
euvd EUVD-2024-47910

Description

The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

References