CVE-2021-37538

9.8 criticalEPSS 74%

Critical (9.8) in smartdatasoft smartblog. EPSS 74% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the id_category parameter to the controllers/front/category.php category controller.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 74% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2021-08-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

smartdatasoft:smartblog

References

https://blog.sorcery.ie/posts/smartblog_sqli/
https://classydevs.com/free-modules/smartblog/
https://blog.sorcery.ie/posts/smartblog_sqli/
https://classydevs.com/free-modules/smartblog/

Check your stack JSON