CVE-2021-26630

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbitrary files. This vulnerability can be exploited by using the file download or execution path as the parameter value of the vulnerable function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Handysoft Co.,LtdHANDY Groupware>= unspecified, <= 1.7.4.6
Handysoft Co.,LtdHANDY Groupware>= unspecified, <= 2.0.3.6
Handysoft Co.,LtdHANDY Groupware>= unspecified, <= 4.0.1.7

References

Timeline

Published
May 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-266317.5Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploiCVE-2021-266339.8SQL injection and Local File Inclusion (LFI) vulnerabilities in MaxBoard can cause information leakage and privilege escalation. This vulnerCVE-2021-266349.8SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files CVE-2021-266357.8In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wroCVE-2021-266369.6Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure aCVE-2021-266379.8There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so unaCVE-2021-266389.8Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. RemoCVE-2021-266397.5This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can uCVE-2021-266429.8When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded dueCVE-2021-266449.8SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin boardCVE-2021-266758.8A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code.CVE-2021-266766.5gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation
CVE-2021-26630: Critical severity, CVSS 9.8 | Vulnix