low3.8
CVE-2020-26625
Gila CMS SQL Injection vulnerability
Impact
A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | gilacms/gila | <= 1.15.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gilacms | Gila Cms | through 1.15.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/GilaCMS/gila
- https://github.com/GilaCMS/gila/security/policy
- https://packetstormsecurity.com/files/176301/GilaCMS-1.15.4-SQL-Injection.html
- https://github.com/advisories/GHSA-3pfj-g4wr-qj3j
- https://nvd.nist.gov/vuln/detail/CVE-2020-26625
- http://gilacms.com