CVE-2021-36807

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 26, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-368087.0A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115.CVE-2021-368096.0A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in aCVE-2021-36815.5A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directory that are not explCVE-2021-36828.5A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulCVE-2021-368216.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows StorCVE-2021-368238.2Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cusmin AGCA - Absolutely Glamorous CusCVE-2021-368265.4Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerability in weDevs WP PrCVE-2021-368274.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress viaCVE-2021-368284.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.CVE-2021-368294.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop Launcher: Coming Soon & Maintenance Mode plugin <= 1.0CVE-2021-36836.5showdoc is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-368304.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress.
CVE-2021-36807: High severity, CVSS 8.8 | Vulnix