CVE-2021-36433

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_mask function in jocms/apps/mask/mask.php.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mxgbr/jocms/issues/6Exploit, Issue Tracking, Third Party Advisory
https://github.com/mxgbr/jocms/issues/6Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Feb 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-364349.1SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_che CVE-2021-364365.3An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via subm CVE-2021-364386.5SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php.CVE-2021-36443.3A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressi CVE-2021-364409.8Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component A CVE-2021-364438.8Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.CVE-2021-364448.8Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token g CVE-2021-36459.8merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-364506.1Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.CVE-2021-364545.4Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) block CVE-2021-364558.8SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.CVE-2021-36466.1btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')