Description
NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application.
Affected products
nlb: mklik makedonija
References7
- cxsecurity.com/issue/WLB-2023100040 Issue TrackingThird Party Advisory
- packetstormsecurity.com/files/175113/NLB-mKlik-Makedonija-3.3.1… Third Party Advisory
- play.google.com/store/apps/details?id=hr.asseco.android.jimba.t… Product
- www.vulncheck.com/advisories/nlb-mklik-macedonia-sql-injection-… Third Party Advisory
- www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php Third Party Advisory
- cxsecurity.com/issue/WLB-2023100040 Issue TrackingThird Party Advisory
- www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5797.php Third Party Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 4.0
-
8.8
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 28 · as of 11 November 2026
- CWE
- CWE-89
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.