VULNERABILITY INTELLIGENCE

CVE-2021-37413

CVSS score9.8 CRITICAL

EPSS probability1.94%

CISA KEVNot currently listed

Published2022-05-19

Last modified2026-06-17

Description

GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated attacker can exploit this vulnerability to obtain administrative access to the webpage, access the user database, modify web content and upload custom files. The backend login script does not verify and sanitize user-provided strings.