CVE-2021-43936

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
Distributed Data SystemsWebHMI>= 4.1, < 4.1

References

Timeline

Published
Dec 6, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439378.8Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request waCVE-2021-439389.8Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authenticatioCVE-2021-439398.8Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests direCVE-2021-43944.3The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missiCVE-2021-439407.8Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the lCVE-2021-439416.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPagCVE-2021-439426.1Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected CroCVE-2021-439434.8Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrCVE-2021-439447.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. AfCVE-2021-439454.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrarCVE-2021-439466.5Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscrCVE-2021-439477.2Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code vi
CVE-2021-43936: Critical severity, CVSS 9.8 | Vulnix