CVE-2021-38290

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-382917.5FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.CVE-2021-382949.8A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior CVE-2021-382957.3In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If CVE-2021-382967.5Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.CVE-2021-382979.8Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH CVE-2021-382989.8Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.CVE-2021-382999.8Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerab CVE-2021-38305.4btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-383007.8arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs CVE-2021-383029.8The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.CVE-2021-383039.8A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.CVE-2021-383047.8Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially