← Database

CVE-2021-36206

CRITICAL CVSS: 10.0 Published: 2022-10-28 Modified: 2026-06-17

Description

All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.

Affected Platforms

Johnsoncontrols Cevas

Weakness Type

CWE-79, CWE-79

References