CVE-2021-4026

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

bookstack is vulnerable to Improper Access Control

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Nov 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-402606.1Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit.CVE-2021-402616.1Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the (1) user_username CVE-2021-402626.5A stack exhaustion issue was discovered in FreeImage before 1.18.0 via the Validate function in PluginRAW.cpp.CVE-2021-402638.8A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.CVE-2021-402646.5NULL pointer dereference vulnerability in FreeImage before 1.18.0 via the FreeImage_CloneTag function inFreeImageTag.cpp.CVE-2021-402658.8A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp.CVE-2021-402666.5FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference.CVE-2021-402726.1OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).CVE-2021-402797.2An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.CVE-2021-40287.8A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local access to setup a soCVE-2021-402807.2An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.CVE-2021-402818.8An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.
CVE-2021-4026: Medium severity, CVSS 4.3 | Vulnix