CVE-2019-7726

Description

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).

How to fix CVE-2019-7726

To remediate CVE-2019-7726, upgrade the affected package to a fixed version below.

• Packagist/nukeviet/nukeviet—upgrade to 4.3.04 or later

Is CVE-2019-7726 being exploited?

Low — EPSS is 2.3%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 4.3.04

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-7726
• WEBgithub.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txt
• WEBgithub.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txt
• WEBgithub.com/nukeviet/nukeviet/compare/4.3.03...4.3.04