Vulnerabilities

TI-2023-20802 CVE-2023-39851 · GHSA-9rfp-wq3q-rh78

webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID…

HIGH 82

webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00846 Published 2023-08-15 No fix listed CWE-89

TI-2023-09089 CVE-2023-22959 · GHSA-36p2-3xmm-mxrv

MEDIUM 61

WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.13703 Published 2023-01-11 No fix listed CWE-89

TI-2019-15113 CVE-2019-20896 · GHSA-64vj-5q8m-pq97

MEDIUM 44

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0099 Published 2020-07-07 No fix listed CWE-89