Vulnerability Database

319,703

Total vulnerabilities in the database

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

  • Published: Aug 23, 2021
  • Updated: Nov 16, 2025
  • CVE: CVE-2021-3694
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.2
  • AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

CVSS v2:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

OWASP TOP 10:

Software From Fixed in
ledgersmb / ledgersmb 1.8.0 1.8.17.x
ledgersmb / ledgersmb 1.7.0 1.7.32.x
ledgersmb / ledgersmb 1.6.0 1.6.33.x
ledgersmb / ledgersmb 1.5.0 1.5.30.x
ledgersmb / ledgersmb 1.4.0 1.4.42.x
ledgersmb / ledgersmb 1.3.0 1.3.47.x
ledgersmb / ledgersmb 1.2.0 1.2.26.x
ledgersmb / ledgersmb 1.1.0 1.1.12.x
debian / debian_linux 10.0 10.0.x
debian / debian_linux 11.0 11.0.x