7.5

CVE-2013-3527

Exploit
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vanillaforums ≫ Vanilla Version <= 2.0.18.7
Vanillaforums ≫ Vanilla Version2.0.1
Vanillaforums ≫ Vanilla Version2.0.2
Vanillaforums ≫ Vanilla Version2.0.3
Vanillaforums ≫ Vanilla Version2.0.4
Vanillaforums ≫ Vanilla Version2.0.5
Vanillaforums ≫ Vanilla Version2.0.6
Vanillaforums ≫ Vanilla Version2.0.7
Vanillaforums ≫ Vanilla Version2.0.8
Vanillaforums ≫ Vanilla Version2.0.9
Vanillaforums ≫ Vanilla Version2.0.10
Vanillaforums ≫ Vanilla Version2.0.11
Vanillaforums ≫ Vanilla Version2.0.12
Vanillaforums ≫ Vanilla Version2.0.13
Vanillaforums ≫ Vanilla Version2.0.14
Vanillaforums ≫ Vanilla Version2.0.15
Vanillaforums ≫ Vanilla Version2.0.16
Vanillaforums ≫ Vanilla Version2.0.16.1
Vanillaforums ≫ Vanilla Version2.0.17
Vanillaforums ≫ Vanilla Version2.0.17.1
Vanillaforums ≫ Vanilla Version2.0.17.2
Vanillaforums ≫ Vanilla Version2.0.17.3
Vanillaforums ≫ Vanilla Version2.0.17.4
Vanillaforums ≫ Vanilla Version2.0.17.5
Vanillaforums ≫ Vanilla Version2.0.17.6
Vanillaforums ≫ Vanilla Version2.0.17.7
Vanillaforums ≫ Vanilla Version2.0.17.8
Vanillaforums ≫ Vanilla Version2.0.17.9
Vanillaforums ≫ Vanilla Version2.0.17.10
Vanillaforums ≫ Vanilla Version2.0.18
Vanillaforums ≫ Vanilla Version2.0.18 Updatealpha3
Vanillaforums ≫ Vanilla Version2.0.18 Updatebeta1
Vanillaforums ≫ Vanilla Version2.0.18 Updatebeta2
Vanillaforums ≫ Vanilla Version2.0.18 Updatebeta4
Vanillaforums ≫ Vanilla Version2.0.18 Updaterc1
Vanillaforums ≫ Vanilla Version2.0.18 Updaterc2
Vanillaforums ≫ Vanilla Version2.0.18 Updaterc3
Vanillaforums ≫ Vanilla Version2.0.18.1
Vanillaforums ≫ Vanilla Version2.0.18.3
Vanillaforums ≫ Vanilla Version2.0.18.4
Vanillaforums ≫ Vanilla Version2.0.18.5
Vanillaforums ≫ Vanilla Version2.0.18.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.64% 0.874
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.