CVE-2021-47812

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-478137.5Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the regisCVE-2021-478145.5NBMonitor 1.6.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration coCVE-2021-478157.5Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the applicatiCVE-2021-478168.8Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitraryCVE-2021-478175.4OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file CVE-2021-478187.5DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long cCVE-2021-478199.8ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitraryCVE-2021-478205.3Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. AttaCVE-2021-478217.5RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configuraCVE-2021-478227.8DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to exeCVE-2021-478237.8Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated CVE-2021-478247.5iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences ta
CVE-2021-47812: Critical severity, CVSS 9.8 | Vulnix