CVE-2018-20715

—

CVSS 3.0

9.8 critical

EPSS

1%p65

Published

Jan 15, 2019 (Jan 15, 2019)

Modified

Jun 17, 2026

Description

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.

Vendors: oxid-esales
Products: eshop
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.