CVE-2020-10190

HIGH

MunkiReport < 5.3.0 - Authenticated SQL Injection via Datatables Endpoint

Title source: llm
STIX 2.1

Description

An issue was discovered in MunkiReport before 5.3.0. An authenticated user could achieve SQL Injection in app/models/tablequery.php by crafting a special payload on the /datatables/data endpoint.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://github.com/munkireport/munkireport-php/releases

Scores

CVSS v3 8.8
EPSS 0.0124
EPSS Percentile 65.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-89
Status published
Products (1)
munkireport_project/munkireport < 5.3.0
Published Mar 09, 2020
Tracked Since Feb 18, 2026