CVE-2021-26600

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://karmainsecurity.com/KIS-2022-01Third Party Advisory
http://packetstormsecurity.com/files/166393/ImpressCMS-1.4.2-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Mar/43Exploit, Mailing List, Third Party Advisory
https://hackerone.com/reports/1081986Exploit, Third Party Advisory
http://karmainsecurity.com/KIS-2022-01Third Party Advisory
http://packetstormsecurity.com/files/166393/ImpressCMS-1.4.2-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2022/Mar/43Exploit, Mailing List, Third Party Advisory
https://hackerone.com/reports/1081986Exploit, Third Party Advisory

Timeline

Published: Mar 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266018.1ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.CVE-2021-266037.8A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability i CVE-2021-266059.8An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred w CVE-2021-266069.8A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficien CVE-2021-266079.8An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected sys CVE-2021-266089.8An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issu CVE-2021-266097.5A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type pa CVE-2021-266108.8The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulne CVE-2021-266119.8HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(r CVE-2021-266129.8An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy CVE-2021-266137.5improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.CVE-2021-266149.8ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable we