CVE-2021-41919

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This is working by adding or replacing a personal profile picture. The affected endpoint is /includes/upload.php on the HTTP POST data. This allows an attacker to exploit the platform by injecting code or malware and, under certain conditions, to execute code on remote user browsers.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/Exploit, Third Party Advisory
https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/Exploit, Third Party Advisory

Timeline

Published: Oct 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41927.8vim is vulnerable to Use After Free CVE-2021-419207.5webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /incl CVE-2021-419219.8novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code ex CVE-2021-419246.1Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).CVE-2021-419289.8SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code vi CVE-2021-419296.1Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers to execute arbitrary CVE-2021-41935.5vim is vulnerable to Out-of-bounds Read CVE-2021-419306.1Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to ex CVE-2021-419319.8The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection CVE-2021-419328.8A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQ CVE-2021-419387.2An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three lo CVE-2021-41946.5bookstack is vulnerable to Improper Access Control