CVE-2013-5640: Raoul Proenca Gnew

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) answer_id or (2) question_id parameter to polls/vote.php, (3) story_id parameter to comments/add.php or (4) comments/edit.php, or (5) thread_id parameter to posts/add.php. NOTE: this issue was SPLIT due to differences in researchers and disclosure dates. CVE-2013-7349 already covers the news_id parameter to news/send.php, user_email parameter to users/register.php, and thread_id to posts/edit.php vectors.

Affected products

• Raoul Proenca Gnew: version 2013.1 only

Published 2014-04-01. Last modified 2026-06-16.