What’s Vulnerable › Vulnerabilities

CVE-2021-28242

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-15 · updated 2026-06-17
• Weakness: CWE-89

Description

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" tab.

Affected products

• b2evolution: 7.2.2

References

• http://packetstormsecurity.com/files/162489/b2evolution-7-2-2-SQL-Injection.html
• https://deadsh0t.medium.com/authenticated-boolean-based-blind-error-based-sql-injection-b752225f0644
• https://github.com/b2evolution/b2evolution/issues/109
• http://packetstormsecurity.com/files/162489/b2evolution-7-2-2-SQL-Injection.html
• https://deadsh0t.medium.com/authenticated-boolean-based-blind-error-based-sql-injection-b752225f0644
• https://github.com/b2evolution/b2evolution/issues/109

Get alerted when CVE-2021-28242 or the next vulnerability affects your stack