CVE-2019-7726

CRITICAL

NukeViet < 4.3.04 - SQL Injection via HTTP Header Data

Title source: llm
STIX 2.1

Description

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).

References (4)

Core 4
Core References
Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04

Scores

CVSS v3 9.8
EPSS 0.0228
EPSS Percentile 81.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (2)
nukeviet/nukeviet < 4.3.04
nukeviet/nukeviet 0 - 4.3.04Packagist
Published Dec 31, 2020
Tracked Since Feb 18, 2026