Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2021-40889

EPSS 0.40% · P60
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2021-40889

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() function to write username in password.php file when a user successfully changed their password. The attacker can inject malicious PHP code into password.php and then use the login function to execute code.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
CMSUno 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CMSUno是法国Jacques Malgrange个人开发者的一款用于创建单页响应式网站的工具。 CMSUno 1.7.2版本存在安全漏洞，该漏洞源于软件受到PHP代码执行漏洞的影响。当用户成功修改密码时，调用file_put_contents()函数在password.php文件中写入用户名。攻击者可利用该漏洞可以在password.php中注入恶意PHP代码，然后使用登录功能执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2021-40889

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-40889

请登录查看更多情报信息。

Same Patch Batch · n/a · 2021-10-11 · 39 CVEs total

CVE-2021-234486.5 MEDIUMPrototype Pollution
CVE-2021-42137Zammad 安全漏洞
CVE-2021-40884Projectsend 安全漏洞
CVE-2021-40886ProjectSend 路径遍历漏洞
CVE-2021-40887ProjectSend 路径遍历漏洞
CVE-2021-40888ProjectSend 跨站脚本漏洞
CVE-2021-35060OpenWay Group WAY4 ACS 安全漏洞
CVE-2021-35059OpenWay Group Way4 Acs 跨站脚本漏洞
CVE-2021-41801MediaWiki 安全漏洞
CVE-2021-42139Deno 代码注入漏洞
CVE-2021-29004rConfig SQL注入漏洞
CVE-2021-42135Hashicorp HashiCorp Vault 安全漏洞
CVE-2021-41055Gajim 安全漏洞
CVE-2021-42134Django 跨站脚本漏洞
CVE-2021-32028PostgreSQL 信息泄露漏洞
CVE-2021-41798MediaWiki 跨站脚本漏洞
CVE-2021-41799MediaWiki 资源管理错误漏洞
CVE-2021-41800MediaWiki 访问控制错误漏洞
CVE-2021-42257Suse Check_smart 输入验证错误漏洞
CVE-2021-42260TinyXML 安全漏洞

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2021-40889

No comments yet

Leave a comment