Official Product Homepageproduct
https://egavilanmedia.com/ CVE-2021-47956
HIGH
EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname
Record summary
CVE-2021-47956 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit.
Description
EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive database information.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 18, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
EgavilanMedia PHPCRUDBrowse Egavilanmedia / EgavilanMedia PHPCRUD | CVE List | 1.0 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBEgavilanMedia PHPCRUD 1.0 - 'First Name' SQL InjectionExploitDB exploitby Dimitrios MitakosNot analyzed1 file
References
5Product Referenceproduct
https://egavilanmedia.com/crud-operation-with-php-mysql-bootstrap-and-dompdf nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-47956 ExploitDB-49878exploit
https://www.exploit-db.com/exploits/49878 VulnCheck Advisory: EgavilanMedia PHPCRUD 1.0 SQL Injection via firstnameThird-party advisory
https://www.vulncheck.com/advisories/egavilanmedia-phpcrud-sql-injection-via-firstname