CVE-2021-40247
9.8
CRITICAL · CVSS 3.1 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username field.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.59% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-01-21 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| oretnom23 | budget and expense tracker system |
References
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/B%26E%20Tracker-by:oretnom23-v1.0
- https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
- https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/B%26E%20Tracker-by:oretnom23-v1.0
- https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
→ the Explorer · watch your stack · NVD