Unscored severity · published Oct 9, 2011
CVE-2010-4940
SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter
–
CVSS
1%
EPSS
No
On KEV
Description
SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wanewsletter · Wanewsletter
2.1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-4940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-4940
packetstormsecurity.org
http://packetstormsecurity.org/1009-exploits/wanewsletter-sql.txt
securityreason.com
http://securityreason.com/securityalert/8462
www.exploit-db.com
http://www.exploit-db.com/exploits/15090
Exploit
http://www.securityfocus.com/bid/43440
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/61993
More from Wanewsletter
–
CVE-2007-2969
PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the waroot parameter