CVE-2021-26626

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter value of the execBrowser function is ‘default’, the first parameter value could be passed to the ShellExecuteW API. The passed parameter is an arbitrary code to be executed. Remote attackers can use this vulnerability to execute arbitrary remote code.

• CWE-20
• CWE-20

• https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662Third Party Advisory
• https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66662Third Party Advisory

Published

Apr 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-26620An improper authentication vulnerability leading to informat…7.5
• CVE-2021-26621An Buffer Overflow vulnerability leading to remote code exec…9.8
• CVE-2021-26622An remote code execution vulnerability due to SSTI vulnerabi…10
• CVE-2021-26623A remote code execution vulnerability due to incomplete chec…9.8
• CVE-2021-26624An local privilege escalation vulnerability due to a "runasr…8.8
• CVE-2021-26625Insufficient Verification of input Data leading to arbitrary…8.8
• CVE-2021-26627Real-time image information exposure is caused by insufficie…7.5
• CVE-2021-26628Insufficient script validation of the admin page enables XSS…6.1
• CVE-2021-26629A path traversal vulnerability in XPLATFORM's runtime archiv…8.8
• CVE-2021-26630Improper input validation vulnerability in HANDY Groupware’s…9.8
• CVE-2021-26631Improper input validation vulnerability in Mangboard commerc…7.5
• CVE-2021-26633SQL injection and Local File Inclusion (LFI) vulnerabilities…9.8