CVE-2021-36622

Katalog CVE

CVSS 9.8 · Critical EPSS 1,9%

Kerentanan Unrestricted Upload of File with Dangerous Type pada online covid vaccination scheduler system project online covid vaccination scheduler system. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload function of profile photo accessible at http://localhost/scheduler/admin/?page=user. An attacker could upload a malicious file such as shell.php with the Content-Type: image/png. Then, the attacker have to visit the uploaded profile photo to access the shell.

Rincian

Terbit di NVD

3 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 78,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/50114 exploit · advisory pihak ketiga · vdb entry