CVE-2021-26753
CRITICALNeDi 1.9C - Authenticated PHP Code Injection via System Files Endpoint
Title source: llmDescription
NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://n4nj0.github.io/advisories/nedi-multiple-vulnerabilities-i/
Scores
CVSS v3
9.9
EPSS
0.0115
EPSS Percentile
62.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Details
CWE
CWE-863
Status
published
Products (1)
nedi/nedi
1.9c
Published
Feb 12, 2021
Tracked Since
Feb 18, 2026