CVE-2021-32849

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-32855.3jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.CVE-2021-328506.1jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handlinCVE-2021-328516.1Mind-elixir is a free, open source mind map core. Prior to version 0.18.1, mind-elixir is prone to cross-site scripting when handling untrusCVE-2021-328529.0Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim musCVE-2021-328539.6Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This CVE-2021-328546.1textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this partCVE-2021-328556.1Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particulCVE-2021-328566.1Microweber is a drag and drop website builder and content management system. Versions 1.2.12 and prior are vulnerable to copy-paste cross-siCVE-2021-328576.1Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bCVE-2021-328586.1esdoc-publish-html-plugin is a plugin for the document maintenance software ESDoc. TheHTML sanitizer in esdoc-publish-html-plugin 1.1.2 and CVE-2021-328596.1The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14CVE-2021-32869.8SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variation of the payload ma
CVE-2021-32849: High severity, CVSS 8.8 | Vulnix