BEdita vulnerable to SQL injection

严重 9.8CVE-2019-15570 · GHSA-9gv2-2m38-j6cx · Published 26/08/2019 · updated 17/06/2026

要点

Package	Affected versions	Patched versions
bedita/bedita Packagist	`< 4.0.0`	`4.0.0`
bedita bedita	`= 4.0.0≤ 3.8.0`	No fix yet

BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters due to a lack of JSON escaping.

NVD description

BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.