CVE-2020-35276

CriticalCVSS 9.8

Published: 21/12/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.53%

72th percentile - higher than 72% of all known CVEs

Summary

EgavilanMedia ECM Address Book 1.0 is vulnerable to SQL injection. An attacker can bypass the Admin Login panel and gain full administrative access.

Risk Assessment

An attacker can take over the application, add or remove any user, leading to data confidentiality and integrity breaches.

Recommendation

Immediately update the application to the latest version or apply a patch fixing the SQL injection vulnerability. In the meantime, consider deploying a Web Application Firewall (WAF) to filter SQL queries.

Original NVD description (English source)

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.