CVE-2021-29012

DMA Softlab Radius Manager 4.4.0 assigns the same session cookie to every admin session. The cookie is valid when the admin is logged in, but is invalid (temporarily) during times when the admin is logged out. In other words, the cookie is functionally equivalent to a static password, and thus provides permanent access if stolen.

• CWE-287

• http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/1d8/publications/tree/main/cve-2021-29012Exploit, Third Party Advisory
• https://sourceforge.net/projects/radiusmanager/Product, Third Party Advisory
• http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/1d8/publications/tree/main/cve-2021-29012Exploit, Third Party Advisory
• https://sourceforge.net/projects/radiusmanager/Product, Third Party Advisory

Published

Apr 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29005Insecure permission of chmod command on rConfig server 3.9.6…8.8
• CVE-2021-29006rConfig 3.9.6 is affected by a Local File Disclosure vulnera…6.5
• CVE-2021-29008A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows…4.8
• CVE-2021-29009A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows…4.8
• CVE-2021-29010A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows…4.8
• CVE-2021-29011DMA Softlab Radius Manager 4.4.0 is affected by Cross Site S…6.1
• CVE-2021-29022In InvoicePlane 1.5.11, the upload feature discloses the ful…5.3
• CVE-2021-29023InvoicePlane 1.5.11 doesn't have any rate-limiting for passw…5.3
• CVE-2021-29024In InvoicePlane 1.5.11 a misconfigured web server allows una…7.5
• CVE-2021-29025A cross-site scripting (XSS) vulnerability in Bitweaver vers…4.8
• CVE-2021-29026A cross-site scripting (XSS) vulnerability in Bitweaver vers…4.8
• CVE-2021-29027A cross-site scripting (XSS) vulnerability in Bitweaver vers…4.8