CVE-2021-46086

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mindskip/xzs-mysql/issues/327Exploit, Issue Tracking, Third Party Advisory
https://github.com/mindskip/xzs-mysql/issues/327Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-460875.4In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameter CVE-2021-460887.2Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run cus CVE-2021-460899.8In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.CVE-2021-460939.8eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.CVE-2021-460978.8Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log CVE-2021-461017.5In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.CVE-2021-461027.5From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_val CVE-2021-461047.5An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on th CVE-2021-461077.5Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any docume CVE-2021-461085.4D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.CVE-2021-461096.1Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hija CVE-2021-461109.8Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno paramete