CVE-2020-21665

2020-11-1715:15:11

Google

osv.dev

7.9 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

37.0%

JSON

In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh.

CPENameOperatorVersion
fastadmineq1.0.0.20180310_beta
fastadmineq1.0.0.20180222_beta
fastadmineq1.0.0.20190410_beta
fastadmineq1.0.0.20191101_beta
fastadmineq1.0.0.20180911_beta
fastadmineq1.0.0.20190418_beta
fastadmineq1.0.0.20181127_beta
fastadmineq1.0.0.20170915_beta
fastadmineq1.0.0.20180630_beta
fastadmineq1.0.0.20190111_beta

Name	Operator	Version
fastadmin	eq	1.0.0.20180310_beta
fastadmin	eq	1.0.0.20180222_beta
fastadmin	eq	1.0.0.20190410_beta
fastadmin	eq	1.0.0.20191101_beta
fastadmin	eq	1.0.0.20180911_beta
fastadmin	eq	1.0.0.20190418_beta
fastadmin	eq	1.0.0.20181127_beta
fastadmin	eq	1.0.0.20170915_beta
fastadmin	eq	1.0.0.20180630_beta
fastadmin	eq	1.0.0.20190111_beta