CyberSec.Space Logo
Back to CVE Browser

CVE-2021-29089

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0570%
EPSS Percentile11.77th
PublishedJun 2, 2021
Last ModifiedNov 21, 2024

Vulnerability Description

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.

Affected Platforms (CPE)

📦
Synology

Photo Station

>= 6.8 and < 6.8.14-3500

References & Advisories

🔗 https://www.synology.com/security/advisory/Synology_SA_20_20
🔗 https://www.synology.com/security/advisory/Synology_SA_20_20

Related Vulnerabilities

CVE-2019-71959.8

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vuln...

CVE-2019-71929.8

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnera...

CVE-2019-71949.8

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vuln...

CVE-2016-103299.8

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitr...