CVE-2021-42333

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-423348.8The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the p CVE-2021-423355.4Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privile CVE-2021-423364.3The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can acce CVE-2021-423374.3The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the CVE-2021-423389.84MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication b CVE-2021-42347.5OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the cl CVE-2021-423407.5The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduce CVE-2021-423417.5checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the en CVE-2021-423429.8An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form variables can be passed to CGI scripts wit CVE-2021-423439.8An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distribu CVE-2021-42355.5Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing use CVE-2021-423576.1When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A