CVE-2024-35678 — SQL Injection in Contact Form TO DB

CWE-89 — SQL Injection3 documents3 sources
Severity
8.8HIGHNVD
CNA8.5
EPSS
0.4%
top 39.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Bestwebsoft Contact Form TO DBBestwebsoft Contact Form TO DB BY Bestwebsoft
Timeline
PublishedJun 8

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-24vv-fh33-8gqp: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft↗2024-06-08
▶
CVEList
WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.2 - SQL Injection vulnerability↗2024-06-08
▶
CVE-2024-35678 — SQL Injection in Contact Form TO DB | cvebase