CVE-2015-2146

9.8 criticalEPSS 1.4%

Critical (9.8) in phpbugtracker project phpbugtracker. EPSS 1.4% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2017-10-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phpbugtracker_project:phpbugtracker

References

http://www.openwall.com/lists/oss-security/2015/02/28/1
https://github.com/a-v-k/phpBugTracker/issues/4
http://www.openwall.com/lists/oss-security/2015/02/28/1
https://github.com/a-v-k/phpBugTracker/issues/4

Check your stack JSON