CVE-2021-47811

CriticalCVSS 9.1/10Last modified Nov 7, 2026

Description

Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the order_by[] parameter in POST requests to the ajax_list endpoint to potentially extract or modify database information.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
GrocerycrudGrocery crud< v2.0.1

References

Timeline

Published
Jan 16, 2026
Last modified
Nov 7, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-478129.8GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP CVE-2021-478137.5Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the regisCVE-2021-478145.5NBMonitor 1.6.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration coCVE-2021-478157.5Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the applicatiCVE-2021-478168.8Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitraryCVE-2021-478175.4OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file CVE-2021-478187.5DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long cCVE-2021-478199.8ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitraryCVE-2021-478205.3Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. AttaCVE-2021-478217.5RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configuraCVE-2021-478227.8DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to exeCVE-2021-478237.8Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated
CVE-2021-47811: Critical severity, CVSS 9.1 | Vulnix