CVE-2021-26634

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-288 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266357.8In the code that verifies the file size in the ark library, it is possible to manipulate the offset read from the target file due to the wro CVE-2021-266369.6Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to information exposure a CVE-2021-266379.8There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-300, GCM-300, so una CVE-2021-266389.8Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remo CVE-2021-266397.5This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Remote attackers can u CVE-2021-266429.8When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due CVE-2021-266449.8SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board CVE-2021-266758.8A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code.CVE-2021-266766.5gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation CVE-2021-266777.8A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8 CVE-2021-266786.1A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior CVE-2021-266797.2A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF