CVE-2020-37242CWE-89sql-injection

CVE-2020-37242

High · published May 16, 2026

CVSS v3.1

8.2

EPSS

Percentile

19.1

In the wild

Unconfirmed

What it is

Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET parameter. Attackers can send crafted requests to the getListForTbl action with boolean-based blind or time-based blind SQL injection payloads to extract sensitive database information.

The record

Technical detail

CVSS v3.1: 8.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00276 · 19.1th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-05-16T20:16Z

References (4)

https://downloads.wordpress.org/plugin/ultimate-maps-by-supsystic.1.1.12.zip · [email protected]https://supsystic.com/ · [email protected]https://www.exploit-db.com/exploits/49532 · [email protected]https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-ultimate-maps-sql-injection-via-sidx · [email protected]

EPSS history

Timeline

16 MAY 15:25Z
WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx
cvelistv5