CVE-2012-2236 EXPLOIT
6.5
MEDIUM · CVSS 2.0 · EPSS 0.9% (pctl 58)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in users.php in PHP Gift Registry 1.5.5 allows remote authenticated users to execute arbitrary SQL commands via the userid parameter in an edit action.
Scoring
| CVSS | 6.5 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| EPSS | 0.89% — more likely to be exploited than 58% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2012-04-20 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| ryan walberg | php gift registry |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | PHP Gift Registry 1.5.5 - SQL Injection | 2012-02-24 |
References
→ the Explorer · watch your stack · NVD