CVE-2021-3694

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-369407.6Microsoft SharePoint Server Spoofing VulnerabilityCVE-2021-369417.8Microsoft Word Remote Code Execution VulnerabilityCVE-2021-369427.5Windows LSA Spoofing VulnerabilityCVE-2021-369434.0Azure CycleCloud Elevation of Privilege VulnerabilityCVE-2021-369457.3Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-369465.4Microsoft Dynamics Business Central Cross-site Scripting VulnerabilityCVE-2021-369478.8Windows Print Spooler Remote Code Execution VulnerabilityCVE-2021-369487.8Windows Update Medic Service Elevation of Privilege VulnerabilityCVE-2021-369497.1Microsoft Azure Active Directory Connect Authentication Bypass VulnerabilityCVE-2021-36954.5A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heaCVE-2021-369505.4Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityCVE-2021-369527.8Visual Studio Remote Code Execution Vulnerability
CVE-2021-3694: Critical severity, CVSS 9.6 | Vulnix