CVE-2011-2917: Mambo-Foundation Mambo

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.

Affected products

• Mambo-Foundation Mambo: up to and including 4.6.5; version 4.6 only; version 4.6.1 only; version 4.6.2 only; version 4.6.3 only; version 4.6.4 only

Published 2011-12-08. Last modified 2026-06-16.