CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.

• CWE-732

• https://sourceforge.net/projects/open-clinic/Third Party Advisory
• https://sourceforge.net/projects/open-clinic/files/latest/downloadThird Party Advisory
• https://www.exploit-db.com/exploits/50448Third Party Advisory, VDB Entry
• https://sourceforge.net/projects/open-clinic/Third Party Advisory
• https://sourceforge.net/projects/open-clinic/files/latest/downloadThird Party Advisory
• https://www.exploit-db.com/exploits/50448Third Party Advisory, VDB Entry

Published

Oct 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37352An open redirect vulnerability exists in Nagios XI before ve…6.1
• CVE-2021-37353Nagios XI Docker Wizard before version 1.1.3 is vulnerable t…9.8
• CVE-2021-37354Xerox Phaser 4622 v35.013.01.000 was discovered to contain a…9.8
• CVE-2021-37358SQL Injection in SEACMS v210530 (2021-05-30) allows remote a…9.8
• CVE-2021-3736A flaw was found in the Linux kernel. A memory leak problem …5.5
• CVE-2021-37363An Insecure Permissions issue exists in Gestionale Open 11.0…7.8
• CVE-2021-37365CTparental before 4.45.03 is vulnerable to cross-site script…6.1
• CVE-2021-37366CTparental before 4.45.03 is vulnerable to cross-site reques…8.8
• CVE-2021-37367CTparental before 4.45.07 is affected by a code execution vu…7.8
• CVE-2021-3737A flaw was found in python. An improperly handled HTTP respo…7.5
• CVE-2021-37371Online Student Admission System 1.0 is affected by an unauth…9.8
• CVE-2021-37372Online Student Admission System 1.0 is affected by an insecu…8.8