CVE-2021-40845

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-408467.5An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, a CVE-2021-408478.1The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code executio CVE-2021-408487.8In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interp CVE-2021-408499.8In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited a CVE-2021-408509.8TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.asmx.CVE-2021-408517.5TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. The exploitation of th CVE-2021-408526.1TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to pages controlled by CVE-2021-408537.2TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could exploit this vulnerabi CVE-2021-408547.8AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to lau CVE-2021-408559.8The EU Technical Specifications for Digital COVID Certificates before 1.1 mishandle certificate governance. A non-production public key cert CVE-2021-408567.5Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.CVE-2021-408578.8Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.