CVE-2021-4097

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

phpservermon is vulnerable to Improper Neutralization of CRLF Sequences

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
phpservermon	phpservermon/phpservermon	>= unspecified, < 3.6.0

References

https://github.com/phpservermon/phpservermon/commit/162bba0046fcda1580f4fbc7b9ababe3c7c13ce4Patch, Third Party Advisory
https://huntr.dev/bounties/d617ced7-be06-4e34-9db0-63d45c003a43Exploit, Patch, Third Party Advisory
https://github.com/phpservermon/phpservermon/commit/162bba0046fcda1580f4fbc7b9ababe3c7c13ce4Patch, Third Party Advisory
https://huntr.dev/bounties/d617ced7-be06-4e34-9db0-63d45c003a43Exploit, Patch, Third Party Advisory

Timeline

Published: Dec 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-409706.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409716.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409726.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409736.1Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject CVE-2021-409756.1Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codei CVE-2021-409787.5The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive infor CVE-2021-40987.4Insufficient data validation in Mojo in Google Chrome prior to 96.0.4664.110 allowed a remote attacker who had compromised the renderer proc CVE-2021-409817.3ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PRO CVE-2021-409855.5A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_loa CVE-2021-409867.2A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 CVE-2021-409877.2A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 CVE-2021-409887.2A remote directory traversal vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prio