« Back to list

CVE-2020-8519

Status: ModifiedCritical (9.8)—

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Phpzag — Phpzag

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2020-8519",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "larry0@me.com",
      "affectedData": [
        {
          "vendor": "phpzag",
          "product": "phpzag live add edit delete data tables records with ajax php mysql",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-07T20:15:10.197",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2020/07/09/1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=213",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "larry0@me.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2020/07/09/1",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vapidlabs.com/advisory.php?v=213",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.phpzag.com/live-add-edit-delete-datatables-records-with-ajax-php-mysql/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql"
    },
    {
      "lang": "es",
      "value": "Una inyección SQL con el parámetro search del archivo Records.php para phpzag live agregar editar eliminar registros de tablas de datos con ajax php mysql"
    }
  ],
  "lastModified": "2026-06-17T03:26:30.610",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpzag:phpzag:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48F1CDD1-16F1-41FF-B4A3-B147EA06000C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "larry0@me.com"
}