CVE-2021-37413

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-374147.5Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.CVE-2021-374159.8Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatioCVE-2021-374166.1Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.CVE-2021-374179.8Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.CVE-2021-374197.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.CVE-2021-37428.8A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerabiCVE-2021-374206.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.CVE-2021-374219.8Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.CVE-2021-374229.8Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.CVE-2021-374239.8Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.CVE-2021-374249.8ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.CVE-2021-374259.1Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or rea
CVE-2021-37413: Critical severity, CVSS 9.8 | Vulnix