CVE-2020-37242 HIGH

CVE-2020-37242: WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx

Vendor Supsystic

Product Ultimate Maps

Weakness CWE-89 · SQLi

Published May 16, 2026

Last update May 18, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

Description

Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'sidx' GET parameter. Attackers can send crafted requests to the getListForTbl action with boolean-based blind or time-based blind SQL injection payloads to extract sensitive database information.

Key dates

Disclosure timeline

May 16, 2026 CVE published

May 18, 2026 Record updated