CVE-2021-37413
CRITICALGRANDCOM DynWEB < 4.2 - Unauthenticated SQL Injection via Admin Login Interface
Title source: llmDescription
GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings.
References (2)
Core 2
Core References
Product x_refsource_misc
https://www.grandcom.sk
Exploit, Third Party Advisory x_refsource_misc
https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-37413.md
Scores
CVSS v3
9.8
EPSS
0.0181
EPSS Percentile
76.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
grandcom/dynweb
< 4.2
Published
May 19, 2022
Tracked Since
Feb 18, 2026