MISP < 2.5.37 - SQL Injection
MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation.
CVSS—EPSS 0.76%
共找到 1 条公开漏洞记录
MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation.