CVE-2014-9528

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier…

published January 6, 2015

CVSS
—
EPSS
2%
Percentile
83.4
In the wild
Unconfirmed
What it is

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02342 · 83.4th percentile
Published
2015-01-06T15:00Z
EPSS history
Timeline
  • 06 JAN 15:00Z
    SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier…
    cvelistv5