Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2021-41975: TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
CVE-2021-41975 · published 5 years ago
Summary
TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
What to do
- Update tadtools_project tadtools to version 3.2.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tadtools_project | tadtools |
< 3.2.2 cpe:2.3:a:tadtools_project:tadtools:*:*:*:*:*:*:*:* |
Original advisory text
TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
TadTools special page is vulnerable to authorization bypass, thus remote attackers can use the specific parameter to delete arbitrary files in the system without logging in.
References
- https://www.twcert.org.tw/tw/cp-132-5174-6f1d5-1.html Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-285Improper Authorization
CWE-306Missing Authentication for Critical Function
Timeline
Published8 Oct 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-41975 · NVD
Track software like this
Free during beta