CVE-2020-15887: Softwareupdate Project Softwareupdate

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.

Affected products

• Softwareupdate Project Softwareupdate: before 1.6 (fixed in 1.6)

Published 2020-07-23. Last modified 2026-06-17.