CVE-2021-30137

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.

• CWE-611

• https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdfExploit, Third Party Advisory
• https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2021-30137.pdfExploit, Third Party Advisory

Published

Sep 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30129A vulnerability in sshd-core of Apache Mina SSHD allows an a…6.5
• CVE-2021-3013ripgrep before 13 on Windows allows attackers to trigger exe…9.8
• CVE-2021-30130phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA …7.5
• CVE-2021-30132Cloudera Manager 7.2.4 has Incorrect Access Control, allowin…9.8
• CVE-2021-30133A cross-site scripting (XSS) vulnerability in CloverDX Serve…6.1
• CVE-2021-30134php-mod/curl (a wrapper of the PHP cURL extension) before 2.…6.1
• CVE-2021-30138Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-30139In Alpine Linux apk-tools before 2.12.5, the tarball parser …7.5
• CVE-2021-3014In MikroTik RouterOS through 2021-01-04, the hotspot login p…6.1
• CVE-2021-30140LiquidFiles 3.4.15 has stored XSS through the "send email" f…5.4
• CVE-2021-30141Module/Settings/UserExport.php in Friendica through 2021.01 …7.5
• CVE-2021-30144The Dashboard plugin through 1.0.2 for GLPI allows remote lo…4.3