CVE-2019-15562

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-155639.8Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.CVE-2019-155649.8The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.CVE-2019-155659.8The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.CVE-2019-155669.8The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.CVE-2019-155679.8OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.CVE-2019-155689.8idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.CVE-2019-155699.8HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirectiCVE-2019-155709.8BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.CVE-2019-155719.8The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.CVE-2019-155729.8Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.CVE-2019-155739.8Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.CVE-2019-155749.8Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
CVE-2019-15562: Critical severity, CVSS 9.8 | Vulnix