CVE-2019-7726

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txtRelease Notes, Third Party Advisory
https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txtRelease Notes, Third Party Advisory
https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04Release Notes, Third Party Advisory
https://github.com/nukeviet/nukeviet/pull/2740/commits/05dfb9b4531f12944fe39556f58449b9a56241bePatch, Third Party Advisory
https://github.com/nukeviet/nukeviet/blob/4.3.04/CHANGELOG.txtRelease Notes, Third Party Advisory
https://github.com/nukeviet/nukeviet/blob/nukeviet4.3/CHANGELOG.txtRelease Notes, Third Party Advisory
https://github.com/nukeviet/nukeviet/compare/4.3.03...4.3.04Release Notes, Third Party Advisory
https://github.com/nukeviet/nukeviet/pull/2740/commits/05dfb9b4531f12944fe39556f58449b9a56241bePatch, Third Party Advisory

Timeline

Published: Dec 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-77279.8In NICE Engage through 6.5, the default configuration binds an unauthenticated JMX/RMI interface to all network interfaces, without restrict CVE-2019-77287.5An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks, a mali CVE-2019-77293.3An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to setting of insecure permissions, a malicious app coul CVE-2019-77305.7MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for deleting a database via the /?q=wrkfrm&type=databases URI.CVE-2019-77319.8MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup CVE-2019-77327.5In Live555 0.95, a setup packet can cause a memory leak leading to DoS because, when there are multiple instances of a single field (usernam CVE-2019-77337.5In Live555 0.95, there is a buffer overflow via a large integer in a Content-Length HTTP header because handleRequestBytes has an unrestrict CVE-2019-77369.8D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101.CVE-2019-77378.8A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit.CVE-2019-77386.5C.P.Sub before 5.3 allows CSRF via a manage.php?p=article_del&id= URI.CVE-2019-77396.1An issue was discovered in Joomla! before 3.9.3. The "No Filtering" textfilter overrides child settings in the Global Configuration. This is CVE-2019-77406.1An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an X