CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Blind SQL Injection.This issue affects Behance Portfolio Manager: from n/a through <= 1.7.5.
Explanation of Vulnerability in Simple Terms
Behance Portfolio Manager versions 1.7.5 and earlier contain a SQL injection vulnerability accessible to high-privilege users. An attacker with administrative or elevated access can inject malicious SQL queries to read sensitive database information. The vulnerability affects the entire application scope and may impact site availability.
What an attacker can do
Read sensitive data from the site database if they have admin or high-level access.
Potential impact on your site
Administrators with compromised accounts could expose user data, portfolio information, or other database contents.
Conditions required to exploit
Attacker must have high-privilege account access (admin or equivalent role).
Key dates
External resources
Related vulnerabilities
