CVE-2020-36768

9.8 criticalEPSS 0.8%

Critical (9.8) in reiner-lemoine-institut nesp2. EPSS 0.8% chance of exploitation in the next 30 days.

A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/database.py. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 07c0cdf36cf6a4345086d07b54423723a496af5e. It is recommended to apply a patch to fix this issue. VDB-246642 is the identifier assigned to this vulnerability.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2023-12-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

reiner-lemoine-institut:nesp2

References

https://github.com/rl-institut/NESP2/commit/07c0cdf36cf6a4345086d07b54423723a496af5e
https://github.com/rl-institut/NESP2/issues/334
https://github.com/rl-institut/NESP2/pull/333
https://vuldb.com/?ctiid.246642
https://vuldb.com/?id.246642

Check your stack JSON