CVE-2021-27950

A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id parameter to mesdocs.ajax.php in azurWebEngine/eShop. By default, the query is executed as DBA.

• CWE-89

• http://www.azurcms.com/Product
• https://raw.githubusercontent.com/post-cyberlabs/CVE-Advisory/main/CVE-2021-27950.pdfExploit, Third Party Advisory
• https://www.sitasoftware.lu/Vendor Advisory
• https://www.sitasoftware.lu/azur/software/web.phpProduct, Vendor Advisory
• http://www.azurcms.com/Product
• https://raw.githubusercontent.com/post-cyberlabs/CVE-Advisory/main/CVE-2021-27950.pdfExploit, Third Party Advisory
• https://www.sitasoftware.lu/Vendor Advisory
• https://www.sitasoftware.lu/azur/software/web.phpProduct, Vendor Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27944Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 …9.8
• CVE-2021-27945The Squirro Insights Engine was affected by a Reflected Cros…6.1
• CVE-2021-27946SQL Injection vulnerability in MyBB before 1.8.26 via poll v…8.8
• CVE-2021-27947SQL Injection vulnerability in MyBB before 1.8.26 via the Co…7.2
• CVE-2021-27948SQL Injection vulnerability in MyBB before 1.8.26 via User G…7.2
• CVE-2021-27949Cross-site Scripting vulnerability in MyBB before 1.8.26 via…6.1
• CVE-2021-27952Hardcoded default root credentials exist on the ecobee3 lite…9.8
• CVE-2021-27953A NULL pointer dereference vulnerability exists on the ecobe…7.5
• CVE-2021-27954A heap-based buffer overflow vulnerability exists on the eco…8.2
• CVE-2021-27956Zoho ManageEngine ADSelfService Plus before 6104 allows stor…6.1
• CVE-2021-27961evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS vi…6.5
• CVE-2021-27962Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x b…7.1