Webchess Project Webchess — known CVE vulnerabilities

Every CVE whose affected-product data names Webchess Project Webchess, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2019-20896 — CVSS 9.8 (critical): WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.
• CVE-2023-39851 — CVSS 9.8 (critical): webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. NOTE: this is disputed…
• CVE-2023-22959 — CVSS 8.8 (high): WebChess through 0.9.0 and 1.0.0.rc2 allows SQL injection: mainmenu.php, chess.php, and opponentspassword.php (txtFirstName, txtLastName).