CVE-2023-26813

2023-04-2820:15:13

Google

osv.dev

sql injection

remote attackers

arbitrary sql commands

tablename parameter

software

8.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

51.0%

JSON

SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.10 allows remote attackers to run arbitrary SQL commands via the TableName parameter to /plugin/dataDictionary/tableView.do.

CPENameOperatorVersion
wangmarketeq4.7
wangmarketeq4.7.1
wangmarketeq4.5
wangmarketeq4.6
wangmarketeq4.8
wangmarketeq4.10
wangmarketeq4.3

Name	Operator	Version
wangmarket	eq	4.7
wangmarket	eq	4.7.1
wangmarket	eq	4.5
wangmarket	eq	4.6
wangmarket	eq	4.8
wangmarket	eq	4.10
wangmarket	eq	4.3

References

github.com/xnx3/wangmarket/issues/7