CVE-2021-37144

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-706

Affected software

No affected versions have been published.

Timeline

Published
Jul 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-371457.2A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attackerCVE-2021-371467.5An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackersCVE-2021-371477.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affectCVE-2021-371487.5Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affectCVE-2021-371497.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affectCVE-2021-37157.8A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changCVE-2021-371507.5Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issuCVE-2021-371515.3CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain autCVE-2021-371525.4Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. An authenticated attacker with the ability to add HTML filesCVE-2021-371539.8ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issCVE-2021-371549.8In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 CVE-2021-371559.8wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the seria