Description
Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hyweb | HyCMS-J1 | unspecified – ≤ 7.4.3 | — |
High · 8.8
CVE-2021-22847
EUVD-2021-9982GHSA-2hjx-vpw3-qh3w
Hyweb HyCMS-J1 - SQL Injection
Published Jan 22, 2021 · Updated Sep 16, 2024 · Assigned by twcert