CVE-2015-1397Not scored
CVE-2015-1397
Vendor not yet named
No fix listed · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.09 (9 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public4 public GitHub repositories (unverified), listed by PoC-in-GitHub7 Apr 2022
- Not established: not seen
55.8%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
What changed
- PoC-in-GitHub lists 4 public GitHub repositories (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SOCRadar, 10 Nov.
- SOCRadar profiles CyberXero’s AI-assisted attacks on UkraineSOCRadar · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.