CVE-2021-44582

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/warmachine-57/CVE-2021-44582/blob/main/Privilege%20Escalation%20via%20Forced%20Browsing%20in%20Sourcecodester%20Money%20Transfer%20Management%20SystemExploit, Third Party Advisory
https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.htmlProduct, Third Party Advisory
https://github.com/warmachine-57/CVE-2021-44582/blob/main/Privilege%20Escalation%20via%20Forced%20Browsing%20in%20Sourcecodester%20Money%20Transfer%20Management%20SystemExploit, Third Party Advisory
https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.htmlProduct, Third Party Advisory

Timeline

Published: Jun 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-445846.1Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script o CVE-2021-445856.1A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.CVE-2021-445867.5An issue was discovered in dst-admin v1.3.0. The product has an unauthorized arbitrary file download vulnerability that can expose sensitive CVE-2021-44596.5An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system informat CVE-2021-445906.5In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. Remote attackers could launch denial of se CVE-2021-445916.5In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks CVE-2021-445938.1Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the usernam CVE-2021-445958.8Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted pack CVE-2021-445969.8Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user CVE-2021-445986.1Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter i CVE-2021-445997.5The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload in CVE-2021-44607.1In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queu