Read the docs
TI-2005-01473 Aliases CVE-2005-1562GHSA-xp63-j3jr-p74v

Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote…

Priority LOW 37Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple SQL injection vulnerabilities in MaxWebPortal 1.3.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fpassword parameter to inc_functions.asp, (2) txtAddress, (3) message, or (4) subject parameter to post_info.asp, (5) andor parameter to search.asp, (6) verkey parameter to pop_profile.asp, or (7) Remove or (8) Delete parameter to pm_delete2.asp.

Why it matters now

EPSS 0.01963 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:maxwebportal:maxwebportal:1.3.0:*:*:*:*:*:*:*1.3.0VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:1.3.2:*:*:*:*:*:*:*1.3.2VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:1.3.3:*:*:*:*:*:*:*1.3.3VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:1.3.5:*:*:*:*:*:*:*1.3.5VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:1.30:*:*:*:*:*:*:*1.30VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:1.31:*:*:*:*:*:*:*1.31VulnerableMaxwebportal
cpe:2.3:a:maxwebportal:maxwebportal:2.0:*:*:*:*:*:*:*2.0VulnerableMaxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.3.2:*:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.3.3:*:*:*:*:*:*:* Versions 1.3.3 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.3.5:*:*:*:*:*:*:* Versions 1.3.5 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.30:*:*:*:*:*:*:* Versions 1.30 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:1.31:*:*:*:*:*:*:* Versions 1.31 Vulnerable ·Maxwebportal
  • cpe:2.3:a:maxwebportal:maxwebportal:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Maxwebportal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-1562
  2. 2026-10-03 Alias added: GHSA-xp63-j3jr-p74v

References

Exploit 1

Other 6

  • TI-2005-01340 Multiple SQL injection vulnerabilities in MaxWebPortal 2.x, 1.35, and other versions… CVSS 2.0HIGH 7.5
  • TI-2003-01115 The default installation of MaxWebPortal 1.30 stores the portal database under the web… CVSS 2.0HIGH 7.5
  • TI-2005-01686 SQL injection vulnerability in password.asp in MaxWebPortal 1.35, 1.36, 2.0, and 20050418… CVSS 2.0HIGH 7.5
  • TI-2005-00957 SQL injection vulnerability in the Update_Events function in events_functions.asp in… CVSS 2.0HIGH 7.5
  • TI-2004-00241 SQL injection vulnerability in MaxWebPortal allows remote attackers to inject arbitrary… CVSS 2.0HIGH 7.5
  • TI-2009-03275 Multiple SQL injection vulnerabilities in forum.asp in MaxWebPortal allow remote… CVSS 2.0HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences