CVE-2021-42534

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Trane	Tracer SC	>= All, <= 3.8

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-292-02Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-292-02Third Party Advisory, US Government Resource

Timeline

Published: Oct 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-425356.1VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used CVE-2021-425366.5The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.CVE-2021-425377.5VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the inte CVE-2021-425388.8The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.CVE-2021-425398.8The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and un CVE-2021-42546.1A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of t CVE-2021-425408.8The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic t CVE-2021-425428.8The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.CVE-2021-425437.8The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, sy CVE-2021-425449.8Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form a CVE-2021-425459.1An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27, which allows a CVE-2021-425466.1Insufficient Input Validation in the search functionality of Wordpress plugin Use-Your-Drive prior to 1.18.3 allows unauthenticated user to