CVE-2020-37163 HIGH

CVE-2020-37163: QuickDate 1.3.2 - SQL Injection

Vendor Quickdate

Product QuickDate

Weakness CWE-89 · SQLi

Published February 6, 2026

Last update February 17, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find_matches endpoint. Attackers can inject UNION-based SQL statements to extract database information including user credentials, database name, and system version.

Key dates

02Disclosure timeline

February 6, 2026 CVE published

February 17, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-37163 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2026-14363 Cargo Extension: SQLi in Special:Drilldown CVE-2026-13551 itsourcecode Baptism Information Management System editBaptism.php sql injection CVE-2026-8441 WP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter CVE-2026-13535 CodeAstro Human Resource Management System View Endpoint Employee_model.php GetFileInfo sql injection CVE-2026-57752 WordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability