CVE-2021-44593

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admin/login.php.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Mister-Joe/CVE-2021-44593Exploit, Third Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44593Exploit, Third Party Advisory
https://www.nu11secur1ty.com/2022/01/cve-2021-44593.htmlExploit, Third Party Advisory
https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.htmlProduct, Third Party Advisory
https://github.com/Mister-Joe/CVE-2021-44593Exploit, Third Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44593Exploit, Third Party Advisory
https://www.nu11secur1ty.com/2022/01/cve-2021-44593.htmlExploit, Third Party Advisory
https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.htmlProduct, Third Party Advisory

Timeline

Published: Jan 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-445958.8Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted pack CVE-2021-445969.8Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user CVE-2021-445986.1Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter i CVE-2021-445997.5The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. A crafted payload in CVE-2021-44607.1In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queu CVE-2021-446007.5The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through th CVE-2021-446075.4A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.CVE-2021-446085.4Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter i CVE-2021-44619.3Seeyon Zhiyuan OA Web Application System versions up to and including 7.0 SP1 improperly decode and parse the `enc` parameter in thirdpartyC CVE-2021-446109.8Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) URLs, (2) lang_id, (3) tmpl_id, (4) mod_rewrite (5) e CVE-2021-446179.8A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.CVE-2021-446189.8A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header