CVE-2021-41975

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-285CWE-306

Affected software

VendorProductVersions
TadTadTools<= 3.2.1

References

Timeline

Published
Oct 8, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-419765.3Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folder nCVE-2021-41986.1A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, AntiviCVE-2021-419878.1In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code CVE-2021-419887.8Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-419897.8Qlik QlikView through 12.60.20100.0 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-41997.8Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender TotaCVE-2021-419907.5The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature. For example,CVE-2021-419917.5The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certifiCVE-2021-419925.6A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bCVE-2021-419934.8A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA byCVE-2021-419944.8A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypassCVE-2021-419957.5A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypas
CVE-2021-41975: Critical severity, CVSS 9.1 | Vulnix