QSearchQSearch

CVE-2021-41566

9.8 CRITICAL

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute ...

Published: 2021-10-08 · Last updated: 2026-06-17

Severity and scoring

CVSS
9.8 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-434

Affected products

VendorProduct
tadtools_projecttadtools

Description

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2021-41975 — TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary fil... (7.5 HIGH)
  • CVE-2021-41565 — TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript ... (6.1 MEDIUM)

Same CWE

  • CVE-2026-40750 — Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server (9.9 CRITICAL)
  • CVE-2026-6933 — The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and inclu... (8.8 HIGH)
  • CVE-2026-40772 — Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions (10.0 CRITICAL)
  • CVE-2026-39591 — Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions (9.9 CRITICAL)
  • CVE-2026-39527 — Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions (5.4 MEDIUM)