CVE-2020-37108

7.1 highEPSS 0.3%

High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.

PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the 'id' parameter to potentially extract or modify database information.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

http://www.allhandsmarketing.com/
http://www.pcollectionnecktie.com/sandbox/
https://www.exploit-db.com/exploits/48138
https://www.vulncheck.com/advisories/phpix-professional-id-sql-injection

Check your stack JSON