CVE

CVE-2021-24285

9.8

CVSS

Description

The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue.

Attack Vector

Privileges Req.

User Interaction

car seller - auto classifieds script

Updated Sep 26, 2026View on NVD →

S4E scanner

criticalProduct Based Web Vulnerabilities~10 seconds

CVE-2021-24285 Scanner

CVE-2021-24285 scanner - SQL Injection vulnerability in Car Seller Auto Classifieds Script

Used 2.6k times · 5.9k assets checked · domain, ipv4, subdomain

Scanner page →Run scanner

CVE history: car seller - auto classifieds script

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →