CVE-2021-36697

With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request.

• CWE-74

• https://k4m1ll0.com/chained_exploit_htaccess.htmlExploit, Third Party Advisory
• https://k4m1ll0.com/chained_exploit_htaccess.htmlExploit, Third Party Advisory

Published

Nov 3, 2021

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3669A flaw was found in the Linux kernel. Measuring usage of the…5.5
• CVE-2021-36690A segmentation fault can occur in the sqlite3.exe command-li…7.5
• CVE-2021-36691libjxl v0.5.0 is affected by a Assertion failed issue in lib…7.5
• CVE-2021-36692libjxl v0.3.7 is affected by a Divide By Zero in issue in li…6.5
• CVE-2021-36695Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in D…5.4
• CVE-2021-36696Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in D…5.4
• CVE-2021-36698Pandora FMS through 755 allows XSS via a new Event Filter wi…5.4
• CVE-2021-3670MaxQueryDuration not honoured in Samba AD DC LDAP6.5
• CVE-2021-36701In htmly version 2.8.1, is vulnerable to an Arbitrary File D…9.1
• CVE-2021-36702The "content" field in the "regular post" page of the "add c…6.1
• CVE-2021-36703The "blog title" field in the "Settings" menu "config" page …6.1
• CVE-2021-36705In ProLink PRC2402M V1.0.18 and older, the set_TR069 functio…9.8