CVE-2020-3973High· 8.8▾ TwilightThe VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.1%
1.1% → 1.1%
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which they are not privileged.
velocloud_orchestrator >= 3.1.1, < 3.3.2velocloud_orchestrator = 3.3.2velocloud_orchestrator = 3.4.0Upgrade past the affected range:
velocloud_orchestrator 3.3.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93952Critical· 10.0VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0
CVE-2025-10405High· 7.3A vulnerability was determined in itsourcecode Baptism Information Management System 1.0
CVE-2025-10479High· 7.3A security flaw has been discovered in SourceCodester Online Student File Management System 1.0
CVE-2025-10387Medium· 6.3A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1
CVE-2025-10068High· 7.3A flaw has been found in itsourcecode Online Discussion Forum 1.0