CVE-2021-32172
CVE-2021-32172
Vexday Risk Score
72High priority
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 66.4%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
07 Oct 2021Published on NVD
08 Oct 2021Public PoC
Weaponization speed
1 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Patch as soon as possible — active exploitation confirmed.
Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/164445/Maian-Cart-3.8-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50394unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.