CVE-2021-41716

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Dec 7, 2021
Last modified
Jul 9, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-417197.5Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using CVE-2021-41725.4Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.CVE-2021-417286.1Cross Site Scripting (XSS) vulnerability exists in Sourcecodester News247 CMS 1.0 via the search function in articles.CVE-2021-417299.1BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the serveCVE-2021-41737.8vim is vulnerable to Use After FreeCVE-2021-417314.8Cross Site Scripting (XSS vulnerability exists in )Sourcecodester News247 News Magazine (CMS) PHP 5.6 or higher and MySQL 5.7 or higher via CVE-2021-417327.5An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based secuCVE-2021-417336.1Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.CVE-2021-417369.8Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.CVE-2021-417377.5In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(333333333333333CVE-2021-417388.8ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to executCVE-2021-417399.8A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with