CVE-2021-37777

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR). Thumbnails uploaded by one site owner are visible by another site owner just by knowing the other site name and fuzzing for picture names. This leads to sensitive information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-377789.8There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution.CVE-2021-37787.8vim is vulnerable to Heap-based Buffer OverflowCVE-2021-377815.4Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.CVE-2021-377829.8Employee Record Management System v 1.2 is vulnerable to SQL Injection via editempprofile.php.CVE-2021-377864.6Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exceptionCVE-2021-377876.5The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POSCVE-2021-377885.4A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a deCVE-2021-377898.1stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_load, leading to Information Disclosure or Denial of Service.CVE-2021-37796.5A malicious MySQL server can request local file content from a client using ruby-mysql prior to version 2.10.0 without explicit authorizatioCVE-2021-377914.9MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin.CVE-2021-377945.4A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a mCVE-2021-37806.1peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')