Back to Database
Status published
Critical
CVE-2020-25990
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php....
Vulnerability Description
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-25990
Credits & Attribution
No credits recorded in the NVD database.
More from websitebaker
View All →CVE-2023-53903
WebsiteBaker 2.13.3 Stored Cross-Site Scripting via SVG File Upload
Medium
5.1
CVE-2023-53902
WebsiteBaker 2.13.3 Directory Traversal via Media Delete Endpoint
High
7
CVE-2017-9771
install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary...
Critical
9.8
CVE-2017-9361
WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php....
Medium
6.1
CVE-2017-9360
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php....
Critical
9.8
Affected Vendor
websitebaker
View all reports →Affected Software
websitebaker
Vulnerable Versions:
2.12.2
Timeline
Official Publish:
October 1st, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.