CVE-2020-26623

LowCVSS 3.8

Published: 02/01/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier. A remote attacker can execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after login.

Risk Assessment

An authenticated attacker can exploit this vulnerability to steal data, modify the database, or escalate privileges, compromising the confidentiality and integrity of the system.

Recommendation

Immediately upgrade Gila CMS to a version later than 1.15.4 that includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.