Vulnerability · Published Apr 5, 2022 · Assigned by mitre
CVE-2022-26986
High 7.2
In plain English
A high-severity security flaw in the impresscms/impresscms package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities).
Severity (CVSS NVD)7.2High
Exploit odds (30 days)4.1%top 9.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | impresscms/impresscms | no fix listed | GHSA-f99r-jjgr-f373 |