Webchess Project Webchess vulnerabilities
3 known vulnerabilities affecting webchess_project/webchess.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH1
Vulnerabilities
Page 1 of 1
CVE-2023-22959P3HIGHCVSS 8.8≤ 0.9.0v1.0.02023-01-11
CVE-2023-22959 [HIGH] CWE-89 CVE-2023-22959: WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspas
WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).
nvd
CVE-2019-20896P3CRITICALCVSS 9.8v1.02020-07-07
CVE-2019-20896 [CRITICAL] CWE-89 CVE-2019-20896: WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.
WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.
nvd
CVE-2023-39851P3CRITICALCVSS 9.8v1.02023-08-15
CVE-2023-39851 [CRITICAL] CWE-89 CVE-2023-39851: webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at
webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed by a third party who indicates that the playerID is a session variable controlled by the server, and thus cannot be used for exploitation.
nvd