CVE-2020-36972
HIGHSmartBlog 2.0.1 - SQL Injection
Title source: llmDescription
SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database information. Attackers can systematically test and retrieve database contents by injecting crafted SQL queries that compare character-by-character of database information.
Exploits (1)
Scores
CVSS v3
8.2
EPSS
0.0004
EPSS Percentile
11.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Details
CWE
CWE-89
Status
published
Products (1)
smartdatasoft/smartblog
2.0.1
Published
Jan 28, 2026
Tracked Since
Feb 18, 2026