title: MapSVG < 6.2.20 - Unauthenticated SQLi
description: The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
problem types: CWE-89 SQL Injection
affected:
{
product: MapSVG
vendor: Unknown
versions:
lessThan: 6.2.20, status: affected, version: 6.2.20, versionType: custom
}