CVE-2020-35337

CRITICAL 9.8CVE-2020-35337 · Published 24/03/2021 · updated 17/06/2026

In short

CVE-2020-35337 is a CRITICAL (CVSS 9.8) vulnerability affecting thinksaas (thinksaas).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 80.2% of all vulnerabilities.
Fix: update to 3.38 or later.

Package	Affected versions	Patched versions
thinksaas thinksaas	`< 3.38`	`3.38`

Description

ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands.

References

blog.unc1e.com/2020/12/thinksaas-has-post-auth-sql-injection.html · Exploit
thinksaas/ThinkSAAS · Third Party Advisory

More vulnerabilities in thinksaas

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

thinksaas

< 3.38

3.38

More vulnerabilities in thinksaas

See all →