CVE-2021-37593

PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly modify database data.

• CWE-89

• http://www.netbytesec.com/advisories/UnauthenticatedBlindSQLInjectionVulnerabilityInPEELShopping/Exploit, Third Party Advisory
• https://github.com/advisto/peel-shopping/issues/3Exploit, Issue Tracking, Third Party Advisory
• https://github.com/faisalfs10x/CVE-IDs/blob/main/2021/CVE-2021-37593/Proof_of_Concept.mdExploit, Third Party Advisory
• http://www.netbytesec.com/advisories/UnauthenticatedBlindSQLInjectionVulnerabilityInPEELShopping/Exploit, Third Party Advisory
• https://github.com/advisto/peel-shopping/issues/3Exploit, Issue Tracking, Third Party Advisory
• https://github.com/faisalfs10x/CVE-IDs/blob/main/2021/CVE-2021-37593/Proof_of_Concept.mdExploit, Third Party Advisory

Published

Jul 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37586The PowerPlay Web component of Mitel Interaction Recording M…4.9
• CVE-2021-37587In Charm 0.43, any single user can decrypt DAC-MACS or MA-AB…6.5
• CVE-2021-37588In Charm 0.43, any two users can collude to achieve the abil…5.9
• CVE-2021-37589Virtua Cobranca before 12R allows SQL Injection on the login…7.5
• CVE-2021-3759A memory overflow vulnerability was found in the Linux kerne…5.5
• CVE-2021-37592Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasio…9.8
• CVE-2021-37594In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_c…9.8
• CVE-2021-37595In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_c…9.8
• CVE-2021-37596Telegram Web K Alpha 0.6.1 allows XSS via a document name.6.1
• CVE-2021-37597WP Cerber before 8.9.3 allows MFA bypass via wordpress_logge…9.8
• CVE-2021-37598WP Cerber before 8.9.3 allows bypass of /wp-json access cont…5.3
• CVE-2021-37599The exporter/Login.aspx login form in the Exporter in Nuance…9.8