CVE-2021-47938

HighCVSS 8.8/10Last modified Oct 6, 2026

Description

ImpressCMS 1.4.2 contains a remote code execution vulnerability in the autotasks administrative interface that allows authenticated attackers to execute arbitrary PHP code by injecting malicious code into the sat_code parameter. Attackers can authenticate, submit a POST request to /modules/system/admin.php?fct=autotasks&op=mod with crafted sat_code containing PHP commands, which creates an executable file that accepts arbitrary commands via GET parameters.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
May 10, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2021

CVE-2021-479398.8Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execuCVE-2021-479409.8WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated atCVE-2021-479418.2WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQCVE-2021-479427.5Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read CVE-2021-479438.8TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by upCVE-2021-479447.5memono Notepad 4.2 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long chaCVE-2021-479457.8Argus Surveillance DVR 4.0 contains an unquoted service path vulnerability in the DVRWatchdog service that allows local attackers to escalatCVE-2021-479465.3OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to CVE-2021-479476.4Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by suCVE-2021-479485.4WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code byCVE-2021-479498.8CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote codCVE-2021-479506.4Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authen
CVE-2021-47938: High severity, CVSS 8.8 | Vulnix