CVE-2024-58290CWE-89sql-injection

CVE-2024-58290

published December 12, 2025

CVSS
9.3
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-12T03:15Z
References (3)
https://elements.envato.com/xhibiter-nft-marketplace-html-template-AQN45FA · [email protected]https://www.exploit-db.com/exploits/52060 · [email protected]https://www.vulncheck.com/advisories/xhibiter-nft-marketplace-sql-injection-via-collections-endpoint · [email protected]
EPSS history
Timeline
  • 11 DEC 21:34Z
    Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint
    cvelistv5