CVE-2007-3526
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to...
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
- Record
CVE-2007-3526- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
- Record
CVE-2007-3526- Updated
- 2026-11-02
EUVDEUVD-2007-3510 No score
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
- Record
EUVD-2007-3510- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vmmw-r7wc-96jr No score
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to...
Multiple SQL injection vulnerabilities in Buddy Zone 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the news_id parameter to view_news.php, (2) the cat_id parameter to view_events.php, or (3) the member_id parameter to video_gallery.php.
- Record
GHSA-vmmw-r7wc-96jr- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Buddy Zone 1.5 - Multiple SQL Injections | 2007-06-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3526 is a high vulnerability (CVSS 7.5) in Vastal I-tech Buddy Zone, published July 3, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. No source names a fixed version.