CVE-2021-4031

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Syltek	Syltek	>= 10.22.00, < 10.22.00

References

https://www.incibe-cert.es/en/early-warning/security-advisories/syltek-insufficient-verification-data-authenticityThird Party Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/syltek-insufficient-verification-data-authenticityThird Party Advisory

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-403105.4OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss CVE-2021-403138.8Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.CVE-2021-403178.8Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.CVE-2021-40324.4A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected.CVE-2021-403239.8Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template i CVE-2021-403247.5Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.CVE-2021-403257.5Cobbler before 3.3.0 allows authorization bypass for modification of settings.CVE-2021-403265.5Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, mishandle hidden and incremental data in signed docum CVE-2021-403275.9Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key (held by the Crypto CVE-2021-403299.8The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.CVE-2021-40336.5kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-403307.5git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cr