CyberSec.Space Logo
Back to CVE Browser

CVE-2021-42258

🔥 Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score85.1160%
EPSS Percentile87.56th
Published2021-10-22
Last Modified2025-11-10
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Affected Platforms (CPE)

📦
Bqe

Billquick Web Suite

>= 19 and < 22.0.9.1

References & Advisories

🔗 https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
🔗 https://www.huntress.com/blog/threat-advisory-hackers-are-exploiting-a-vulnerability-in-popular-billing-software-to-deploy-ransomware
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42258

Related Vulnerabilities

CVE-2026-674394.3

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/...

CVE-2026-674386.6

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/execu...

CVE-2026-674377.5

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/...

CVE-2026-466786.8

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an applic...