CVE-2021-38841
8.8 HIGHRemote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the System Logo option on the system_info pag...
Published: 2021-09-07 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 8.8 HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-434
Affected products
| Vendor | Product |
|---|---|
| simple_water_refilling_station_management_system_project | simple_water_refilling_station_management_system |
Description
Remote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the System Logo option on the system_info page in classes/SystemSettings.php with an update_settings action.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38841
- [Exploit reference]https://www.exploit-db.com/exploits/50205
- [Other]https://www.sourcecodester.com/php/14906/simple-water-refilling-station-management-system-php-free-source-code.html
- [Other]https://www.sourcecodester.com/users/tips23
- [Exploit reference]https://www.exploit-db.com/exploits/50205
- [Other]https://www.sourcecodester.com/php/14906/simple-water-refilling-station-management-system-php-free-source-code.html
- [Other]https://www.sourcecodester.com/users/tips23
Related CVEs
Same vendor
- CVE-2021-38840 — SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter (9.8 CRITICAL)
Same CWE
- CVE-2026-40750 — Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server (9.9 CRITICAL)
- CVE-2026-6933 — The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and inclu... (8.8 HIGH)
- CVE-2026-40772 — Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions (10.0 CRITICAL)
- CVE-2026-39591 — Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions (9.9 CRITICAL)
- CVE-2026-39527 — Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions (5.4 MEDIUM)