CVE-2020-37076

8.8 highEPSS 0.4%

High (8.8) in victor cms project victor cms. EPSS 0.4% chance of exploitation in the next 30 days.

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted UNION SELECT payloads to extract database information through boolean-based, error-based, and time-based injection techniques.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

victor_cms_project:victor_cms

References

https://github.com/VictorAlagwu/CMSsite
https://www.exploit-db.com/exploits/48451
https://www.vulncheck.com/advisories/victor-cms-post-sql-injection

Check your stack JSON