// For flags

CVE-2021-26634

Maxboard multiple vulnerabilities

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

Unos ataques de inyección SQL y de carga de archivos son posibles debido a la insuficiente comprobación de los valores de entrada en algunos parámetros y variables de los archivos que comprometen a Maxboard, lo que puede conllevar a una ejecución de código arbitrario o la escalada de privilegios. Los atacantes pueden usar estas vulnerabilidades para llevar a cabo ataques como el robo de derechos de administración del servidor usando un shell web

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-02-03 CVE Reserved
  • 2022-06-01 CVE Published
  • 2024-08-03 CVE Updated
  • 2025-02-14 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • CWE-288: Authentication Bypass Using an Alternate Path or Channel
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Maxb
Search vendor "Maxb"
 Maxboard
Search vendor "Maxb" for product "Maxboard"
 < 1.9.6
Search vendor "Maxb" for product "Maxboard" and version " < 1.9.6"
-
Affected
in Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
--
Safe