CVE-2021-46067
9.8
CRITICAL · CVSS 3.1 · EPSS 5.1% (pctl 92)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.14% — more likely to be exploited than 92% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2022-01-06 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| vehicle service management system project | vehicle service management system |
References
- https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-Cookie-Stealing-Leads-to-Full-Account-Takeover
- https://www.plsanu.com/vehicle-service-management-system-multiple-cookie-stealing-leads-to-full-account-takeover
- https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-Cookie-Stealing-Leads-to-Full-Account-Takeover
- https://www.plsanu.com/vehicle-service-management-system-multiple-cookie-stealing-leads-to-full-account-takeover
→ the Explorer · watch your stack · NVD