Loading...
Skip to main content
GeekWala

CVE-2020-21809 — Vulnerability in nukeviet/nukeviet — CVE Details

CRITICAL

NukeViet SQL Injection vulnerability

Published May 24, 2022Updated April 24, 2024Source: osv

Summary

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php. ### Fix Implementation: Download the update package corresponding to the NukeViet version you are using, extract and upload to hosting according to NukeViet's structure: For NukeViet 4.0 Official (4.0.29) For NukeViet 4.1 Official (4.1.02) For NukeViet 4.2 (4.2.01) As for NukeViet 4.3, you can update according to the notice in the admin page or see here: https://nukeviet.vn/vi/news/Tin-tuc/thong-bao-phat-hanh-nukeviet-4- 3-08-613.html

Advisory Timeline

  • First published May 24, 2022 (1602 days ago).
  • Last revised April 24, 2024 — 701 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update nukeviet/nukeviet to 4.0.29 or later
composer require "nukeviet/nukeviet:^4.0.29"
Composer
Update nukeviet/nukeviet to 4.1.02 or later
composer require "nukeviet/nukeviet:^4.1.02"
Composer
Update nukeviet/nukeviet to 4.2.01 or later
composer require "nukeviet/nukeviet:^4.2.01"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
nukeviet/nukeviet
packagist
4.0.244.0.29
nukeviet/nukeviet
packagist
All versions4.1.02
nukeviet/nukeviet
packagist
All versions4.2.01
nukeviet/nukeviet
packagist
4.3No fix available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2020-21809?
NukeViet SQL Injection vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2020-21809?
CVE-2020-21809 affects nukeviet/nukeviet. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2020-21809 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-m8jx-mxf9-2rpw

Related CVEs

  • CVE-2026-107845
    CRITICAL

    Contao: Cross-site scripting in the comments bundle

  • CVE-2020-21808
    CRITICAL

    NukeViet SQL Injection vulnerability via topicsid parameter

  • CVE-2026-92161
    CRITICAL

    FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

  • CVE-2026-54064
    HIGH

    NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News Module

  • CVE-2026-41147
    HIGH

    NukeViet CMS: Stored Cross-Site Scripting (XSS) via insufficient server-side input sanitization in Request class

  • CVE-2026-54065
    HIGH

    NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

  • CVE-2026-48118
    HIGH

    NukeViet: Unauthenticated Reflected XSS in Comment Module

  • CVE-2026-49259
    HIGH

    NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies