Webchess Project

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Webchess Project records in CISA KEV

No Webchess Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

3 records in Webchess · all components

TI-2023-20802 CVE-2023-39851 · GHSA-9rfp-wq3q-rh78

HIGH 82

webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00846 Published 2023-08-15 No fix listed CWE-89

TI-2023-09089 CVE-2023-22959 · GHSA-36p2-3xmm-mxrv

MEDIUM 61

WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.13703 Published 2023-01-11 No fix listed CWE-89

TI-2019-15113 CVE-2019-20896 · GHSA-64vj-5q8m-pq97

MEDIUM 44

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0099 Published 2020-07-07 No fix listed CWE-89