CVE-2020-9406 - IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service

CRITICAL

IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service

Published Feb 25, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.23%

IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

Link	Providers	Tags
https://github.com/dawid-czarnecki/public-vulnerabilities/tree/master/Online_Weather		Third Party Advisory
https://zigrin.com/advisories/online-weather-command-injection-in-querybcp-method/

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Feb 25, 2020

Updated Aug 4, 2024

Reserved Feb 25, 2020

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a