by Kastro
Paper/Archive/CVE-2021-26634

CVE-2021-26634

Max Yi Maxboard — Maxboard multiple vulnerabilities

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.0.720 × 2014.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

Affected

ProductAffectedFixed inSource
Maxboardunspecified – 1.9.5.1–CNA

Scores by source

krcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refkrcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66746