{"id":"CVE-2020-36537","aliases":["EUVD-2020-24013","GHSA-37mg-65fg-9hr9"],"status":"published","title":"Everywhere CMS sql injection","description":"A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00669,"percentile":0.52226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2022-06-03T19:10:50Z","modified":"2026-06-17T03:15:41Z","products":[{"vendor":"everywhere","product":"cms"},{"vendor":"everywhere","product":"everywhere_cms"},{"vendor":"statamic","product":"cms"}],"references":[{"url":"https://vuldb.com/?id.159954","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36537"},{"url":"https://github.com/advisories/GHSA-37mg-65fg-9hr9"}],"sources":{"cve":[{"id":"CVE-2020-36537","title":"Everywhere CMS sql injection","description":"A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely.","status":"published","published":"2022-06-03T19:10:50Z","modified":"2025-04-15T14:35:01.363Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-24013","description":"A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely.","status":"published","published":"2022-06-03T19:10:50Z","modified":"2025-04-15T14:35:01Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:28.823587Z"}],"ghsa":[{"id":"GHSA-37mg-65fg-9hr9","title":"A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an...","description":"A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely.","status":"published","published":"2022-06-08T00:00:41Z","modified":"2023-01-27T05:03:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:42:14.754174Z"}],"nvd":[{"id":"CVE-2020-36537","description":"A vulnerability was found in Everywhere CMS. It has been classified as critical. Affected is an unknown function. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely.","status":"published","published":"2022-06-07T18:15:11.233Z","modified":"2026-06-17T03:15:41.253Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:06:46.951463Z"}]}}