Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.
AnalysisAI
An issue was discovered in Programi 014 31.01.2020. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities. Affected products include: Bilanc.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Rated high severity (CVSS 7.4), t
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. Rated critical severity
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to differ
An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. Rated high severity (CVS
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today