{"id":"CVE-2020-21665","details":"In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh.","modified":"2026-07-07T08:50:39.448679230Z","published":"2020-11-17T15:15:11.867Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"1.0.0.20191212-beta"},{"last_affected":"1.0.0.20191212-beta"}],"source":"CPE_STRING","vendor_product":"fastadmin:fastadmin","cpes":["cpe:2.3:a:fastadmin:fastadmin:1.0.0.20191212:beta:*:*:*:*:*:*"]}]},"references":[{"type":"FIX","url":"https://github.com/karsonzhang/fastadmin/commit/e14008ca029d644e2486873fa22629a1d62a7380"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fastadminnet/fastadmin","events":[{"introduced":"0"},{"fixed":"e14008ca029d644e2486873fa22629a1d62a7380"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.0.0.20191212_beta","v1.0.0.20191101_beta","v1.0.0.20190930_beta","v1.0.0.20190705_beta","v1.0.0.20190628_beta","v1.0.0.20190510_beta","v1.0.0.20190418_beta","v1.0.0.20190410_beta","v1.0.0.20190407_beta","v1.0.0.20190318_beta","v1.0.0.20190301_beta","v1.0.0.20190111_beta","v1.0.0.20181210_beta","v1.0.0.20181127_beta","v1.0.0.20181031_beta","v1.0.0.20180911_beta","v1.0.0.20180806_beta","v1.0.0.20180630_beta","v1.0.0.20180618_beta","v1.0.0.20180513_beta","v1.0.0.20180506_beta","v1.0.0.20180417_beta","v1.0.0.20180406_beta","v1.0.0.20180401_beta","v1.0.0.20180327_beta","v1.0.0.20180314_beta","v1.0.0.20180310_beta","v1.0.0.20180308_beta","v1.0.0.20180222_beta","v1.0.0.20180204_beta","v1.0.0.20180119_beta","v1.0.0.20180117_beta","v1.0.0.20171206_beta","v1.0.0.20171026_beta","v1.0.0.20170915_beta","v1.0.0.20170816_beta","v1.0.0.20170808_beta","v0.1.0.20170721_beta"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-21665.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}