CVE-2021-47702

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OpenBMCS 2.4 contains a CSRF vulnerability that allows attackers to perform actions with administrative privileges by exploiting the sendFeedback.php endpoint. Attackers can submit malicious requests to trigger unintended actions, such as sending emails or modifying system settings.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 9, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-477037.2OpenBMCS 2.4 contains an unauthenticated SSRF vulnerability that allows attackers to bypass firewalls and initiate service and network enumeCVE-2021-477046.5OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitraCVE-2021-477058.7COMMAX UMS Client ActiveX Control 1.7.0.2 contains a heap-based buffer overflow vulnerability that allows attackers to execute arbitrary codCVE-2021-477068.7COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to accessCVE-2021-477079.3COMMAX CVD-Axx DVR 5.1.4 contains weak default administrative credentials that allow remote password attacks and disclose RTSP stream. AttacCVE-2021-477089.3COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitCVE-2021-477098.7COMMAX Smart Home System allows an unauthenticated attacker to change configuration and cause denial-of-service through the setconf endpointCVE-2021-477108.7COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by CVE-2021-477118.8A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro mCVE-2021-477127.5A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanCVE-2021-477137.5Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQLCVE-2021-477145.5Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the quer