CVE-2021-28132

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://abuyv.com/cve/lucy-file-upload-RCEExploit, Third Party Advisory
https://abuyv.com/cve/lucy-file-upload-RCEExploit, Third Party Advisory

Timeline

Published: Mar 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-281334.3Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attem CVE-2021-281349.8Clipper before 1.0.5 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer CVE-2021-281356.5The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited L CVE-2021-281366.5The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capabili CVE-2021-281398.8The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an L CVE-2021-281419.8An issue was discovered in Progress Telerik UI for ASP.NET AJAX 2021.1.224. It allows unauthorized access to MicrosoftAjax.js through the Te CVE-2021-281428.8CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."CVE-2021-281438.0/jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping, ping6, or traceroute (under System Tools).CVE-2021-281448.8prog.cgi on D-Link DIR-3060 devices before 1.11b04 HF2 allows remote authenticated users to inject arbitrary commands in an admin or root co CVE-2021-281455.4Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This req CVE-2021-281466.5The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an externa CVE-2021-281476.5The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control iss