CVE-2021-3029

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 7, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-302907.0Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, SnapdrCVE-2021-302917.8Possible memory corruption due to lack of validation of client data used for memory allocation in Snapdragon Auto, Snapdragon Compute, SnapdCVE-2021-302927.8Possible memory corruption due to lack of validation of client data used for memory allocation in Snapdragon Auto, Snapdragon Compute, SnapdCVE-2021-302937.5Possible assertion due to lack of input validation in PUSCH configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SCVE-2021-302945.5Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon ConCVE-2021-302957.8Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, SnapdCVE-2021-302977.1Possible out of bound read due to improper validation of packet length while handling data transfer in VR service in Snapdragon Auto, SnapdrCVE-2021-302987.8Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interfaCVE-2021-302996.7Possible out of bound access in audio module due to lack of validation of user provided input.CVE-2021-30306.1Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in coloCVE-2021-303007.5Possible denial of service due to incorrectly decoding hex data for the SIB2 OTA message and assigning a garbage value to choice when procesCVE-2021-303017.5Possible denial of service due to out of memory while processing RRC and NAS OTA message in Snapdragon Auto, Snapdragon Industrial IOT, Snap