CVE-2019-12946

Elcom CMS prior to version 10.7 is vulnerable to SQL Injection via EventSearchByState.aspx and EventSearchAdv.aspx. The issue allows an attacker to influence a SQL query through these endpoints, with a high impact on confidentiality (as reflected by CVSS). The evidence comes from multiple sources...