CVE-2017-1000423: b2evolution

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.

Affected products

• b2evolution b2evolution: from 6.6.0, up to and including 6.8.10

Published 2018-01-02. Last modified 2026-06-17.