CVE-2020-21012

CriticalCVSS 9.8/10Last modified Oct 22, 2026

Description

Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2021
Last modified: Oct 22, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-210137.2emlog v6.0.0 contains a SQL injection via /admin/comment.php.CVE-2020-210146.5emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.CVE-2020-210169.8D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.CVE-2020-21025.3Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.CVE-2020-21035.4Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.CVE-2020-210386.1Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.CVE-2020-21044.3Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.CVE-2020-210417.5Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user CVE-2020-210467.8A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader CVE-2020-210475.5The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused b CVE-2020-210486.5An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.CVE-2020-210496.5An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted P