CVE-2021-32972

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser to access the URI and embed the contents, which may allow the attacker to disclose information that is accessible in the context of the user executing software.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	Panasonic FPWIN Pro	All Versions 7.5.1.1 and prior

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-180-03Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-180-03Third Party Advisory, US Government Resource

Timeline

Published: Jul 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-329749.8Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote at CVE-2021-329757.8Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-CVE-2021-329769.8Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attack CVE-2021-329777.2AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.CVE-2021-329787.5The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered passwo CVE-2021-329797.5Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a CVE-2021-32985.4Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manage CVE-2021-329809.8Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming co CVE-2021-329817.2AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or d CVE-2021-329827.5Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and projec CVE-2021-329839.8A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and p CVE-2021-329849.8All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Dir