CVE-2021-26605

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launcher received and executed crafted input values through JSON-RPC communication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-266069.8A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficienCVE-2021-266079.8An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected sysCVE-2021-266089.8An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issuCVE-2021-266097.5A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type paCVE-2021-266108.8The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulneCVE-2021-266119.8HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(rCVE-2021-266129.8An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copyCVE-2021-266137.5improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.CVE-2021-266149.8ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable weCVE-2021-266158.8ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an intCVE-2021-266169.8An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.CVE-2021-266179.8This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to exe