CVE-2021-36484

EUVD-2021-23086
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
jizhicmsjizhicms
1.9.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.notion.so/JIZHICMS-v1-9-5-SQL-Injection-3a71102958584a20bf22c052c7778bbd
https://www.notion.so/JIZHICMS-v1-9-5-SQL-Injection-3a71102958584a20bf22c052c7778bbd