CVE-2021-46079

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-InjectionExploit, Third Party Advisory
https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injectionExploit, Third Party Advisory
https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-InjectionExploit, Third Party Advisory
https://www.plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injectionExploit, Third Party Advisory

Timeline

Published: Jan 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-460804.8A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Store CVE-2021-460827.5Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discove CVE-2021-460835.4uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.CVE-2021-460845.4uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.CVE-2021-460856.5OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority CVE-2021-460867.5xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There i CVE-2021-460875.4In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameter CVE-2021-460887.2Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run cus CVE-2021-460899.8In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.CVE-2021-460939.8eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.CVE-2021-460978.8Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log CVE-2021-461017.5In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.