CVE-2021-41492

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page in cashiering. (2) id parameter in manage_products and the (3) t paramater in actions.php.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://3xpl017.blogspot.com/2021/09/multiple-sql-injections-in.htmlThird Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41492Exploit, Third Party Advisory
https://www.nu11secur1ty.com/2021/12/cve-2021-41492.htmlExploit, Third Party Advisory
https://3xpl017.blogspot.com/2021/09/multiple-sql-injections-in.htmlThird Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41492Exploit, Third Party Advisory
https://www.nu11secur1ty.com/2021/12/cve-2021-41492.htmlExploit, Third Party Advisory

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-414955.3Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due to missing return-val CVE-2021-414965.5Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service a CVE-2021-414977.5Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Den CVE-2021-414987.5Buffer overflow in ajaxsoundstudio.com Pyo &lt and 1.03 in the Server_jack_init function. which allows attackers to conduct Denial of Servic CVE-2021-414997.5Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to cond CVE-2021-41505.5A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges c CVE-2021-415007.5Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt CVE-2021-415025.4An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScri CVE-2021-415038.0DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices co CVE-2021-415048.0An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the dev CVE-2021-415069.8Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R CVE-2021-415119.8The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to b