Is CVE-2012-0938 actively exploited?

No active exploitation of CVE-2012-0938 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2012-0938 be exploited remotely?

Yes. CVE-2012-0938 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2012-0938?

CVE-2012-0938 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2012-0938

MEDIUM

CVE-2012-0938

CWE-89Published: August 14, 2014· Updated: Jun 16, 2026

6.5

CVSS v3.1

Official Description

Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/. NOTE: some of these details are obtained from third party information.

NVD Source

Technical Analysis

CVE-2012-0938 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.