CVE-2021-40881

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-408826.1A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.CVE-2021-408839.8A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.CVE-2021-408848.1Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-eCVE-2021-408866.5Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` paramCVE-2021-408879.8Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, aCVE-2021-408885.4Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() fuCVE-2021-408899.8CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_putCVE-2021-40894.3snipe-it is vulnerable to Improper Access ControlCVE-2021-408927.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) stCVE-2021-408937.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.CVE-2021-408947.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is cCVE-2021-408957.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in todo-regex v0.1.1 when matching crafted invalid TODO statemen
CVE-2021-40881: Critical severity, CVSS 9.8 | Vulnix