CVE-2026-4815: fallo de gravedad alta en Schiocco Support Board
SQL Injection vulnerability in Support Board
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.2%
probabilidad de explotación
0.2%top 86% de las CVE
explotación observada
noninguna fuente lo reporta
A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Schiocco · Support BoardCVEs relacionadas — Schiocco Support Board
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-4828CRITICALSupport Board <= 3.8.0 - Unauthenticated Arbitrary File DeletionEPSS 0.9%CVE-2025-54031HIGHWordPress Support Board <= 3.8.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2026-27395CRITICALWordPress Support Board plugin < 3.8.9 - Privilege Escalation vulnerabilityEPSS 0.5%CVE-2025-4855CRITICALSupport Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret KeyEPSS 0.4%CVE-2025-54027HIGHWordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-4816MEDIUMReflected Cross Site Scripting (XSS) vulnerability in Support BoardEPSS 0.2%