CVE-2026-4815

CVE Enrichment

CVSS: 8.7 HIGH
EPSS: 0.24%
EPSS Percentile: 14.38%
CISA KEV: Not listed

Description

A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: cve-coordination@incibe.es
Published: 25-Mar-2026 21:16
Last Modified: 17-Jun-2026 17:57
EPSS Date: 2026-10-11
CWE: CWE-89

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

schiocco / support_board
Version / affected range: * · before (exclusive) 3.7.8
cpe:2.3:a:schiocco:support_board:*:*:*:*:*:wordpress:*:*

References

cve-coordination@incibe.es

Last enrichment sync: 12-Oct-2026 19:09
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize control of CyberXero Used Claude Code in Campaign That Stole 628,000+ Ukrainian Records

CVE (3)

Threat Actors (2)

MITRE ATT&CK (3)

Products (6)

Tools (3)

Industries (4)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.