CVE-2021-33816

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2021/Nov/39Exploit, Mailing List, Third Party Advisory
https://trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txtExploit, Third Party Advisory
https://trovent.io/security-advisory-2106-01Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Nov/39Exploit, Mailing List, Third Party Advisory
https://trovent.github.io/security-advisories/TRSA-2106-01/TRSA-2106-01.txtExploit, Third Party Advisory
https://trovent.io/security-advisory-2106-01Exploit, Third Party Advisory

Timeline

Published: Nov 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-338187.5An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. Attackers can use slowhttptest tool to send incomplete HTTP CVE-2021-33827.5Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors r CVE-2021-338207.5An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make w CVE-2021-338227.5An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. Attackers can use slowhttptest tool to send incomplete HTTP request,CVE-2021-338237.5An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attacker could send a huge amount of TCP SYN packet to make web ser CVE-2021-338247.5An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request CVE-2021-338277.2The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.CVE-2021-338288.8The files_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploade CVE-2021-338296.1A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attack CVE-2021-338316.5api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control. An attacker can CVE-2021-338339.8ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGT CVE-2021-338347.1An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buff