title: Mediamatic < 2.8.1 - Subscriber+ SQL Injection
description: The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection
problem types: CWE-89 SQL Injection
affected:
{
product: Mediamatic – Media Library Folders
vendor: Unknown
versions:
lessThan: 2.8.1, status: affected, version: 2.8.1, versionType: custom
}