CVE-2021-30181

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

• https://lists.apache.org/thread.html/re22410dc704a09bc7032ddf15140cf5e7df3e8ece390fc9032ff5587%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory
• https://lists.apache.org/thread.html/re22410dc704a09bc7032ddf15140cf5e7df3e8ece390fc9032ff5587%40%3Cdev.dubbo.apache.org%3EMailing List, Vendor Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30176The ZEROF Expert pro/2.0 application for mobile devices allo…9.8
• CVE-2021-30177There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in …9.8
• CVE-2021-30178An issue was discovered in the Linux kernel through 5.11.11.…5.5
• CVE-2021-30179Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports ge…9.8
• CVE-2021-3018ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerabl…9.8
• CVE-2021-30180Apache Dubbo prior to 2.7.9 support Tag routing which will e…9.8
• CVE-2021-30183Cleartext storage of sensitive information in multiple versi…7.5
• CVE-2021-30184GNU Chess 6.2.7 allows attackers to execute arbitrary code v…7.8
• CVE-2021-30185CERN Indico before 2.3.4 can use an attacker-supplied Host h…7.5
• CVE-2021-30186CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-base…7.5
• CVE-2021-30187CODESYS V2 runtime system SP before 2.4.7.55 has Improper Ne…5.3
• CVE-2021-30188CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-bas…9.8