CVE-2021-41746

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/purple-WL/Yonyou-TurboCRM-SQL-injection/issues/1Exploit, Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2020-21956Third Party Advisory
https://github.com/purple-WL/Yonyou-TurboCRM-SQL-injection/issues/1Exploit, Third Party Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2020-21956Third Party Advisory

Timeline

Published: Oct 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-417476.1Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensitive information such CVE-2021-417499.8In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injectio CVE-2021-41755.4livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-417506.1A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web scr CVE-2021-417519.8Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscrip CVE-2021-417529.8Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recur CVE-2021-417537.5A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remo CVE-2021-417549.8dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.CVE-2021-417559.8dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.CVE-2021-417569.8dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.CVE-2021-41766.1livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-417648.8A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks i