CVE-2020-6114CWE-89

An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit…

Medium · published July 10, 2020

CVSS v3.0
6.6
EPSS
2%
Percentile
77.4
In the wild
Unconfirmed
What it is

An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.

The record
Technical detail
CVSS v3.0
6.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01727 · 77.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2020-07-10T17:51Z
EPSS history
Timeline
  • 10 JUL 17:51Z
    An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit…
    cvelistv5