CVE-2021-46686

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in acmailer CGI ver.4.0.3 and earlier and acmailer DB ver.1.1.5 and earlier. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Extra Innovation Inc.	acmailer CGI	ver.4.0.3 and earlier
Extra Innovation Inc.	acmailer DB	ver.1.1.5 and earlier

References

Timeline

Published: Feb 18, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2021

CVE-2021-466874.9JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. CVE-2021-466997.8A vulnerability has been identified in Simcenter Femap (All versions < V2022.1.1). Affected application contains a stack based buffer overfl CVE-2021-467006.5In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double free.CVE-2021-467016.5PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit events to a socket,CVE-2021-467025.5Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended CVE-2021-467039.8In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandbox CVE-2021-467049.8In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/u CVE-2021-467054.4A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attacker CVE-2021-467086.1The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuadin CVE-2021-467096.1phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).CVE-2021-467407.5The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnera CVE-2021-467417.5The basic framework and setting module have defects, which were introduced during the design. Successful exploitation of this vulnerability