CVE-2021-37933

An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify the logic of an LDAP query and bypass authentication. The vulnerability is due to insufficient server-side validation of the email parameter before using it to construct LDAP queries. An attacker could bypass authentication exploiting this vulnerability by sending login attempts in which there is a valid password but a wildcard character in email parameter.

• CWE-74

• https://gist.github.com/andrey-lomtev/cbf12bc8d8763996cf8d6d1641a0b049Exploit, Third Party Advisory
• https://gist.github.com/andrey-lomtev/cbf12bc8d8763996cf8d6d1641a0b049Exploit, Third Party Advisory

Published

Oct 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37927Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37928Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37929Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-3793An improper access control vulnerability was reported in som…5.3
• CVE-2021-37930Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37931Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37934Due to insufficient server-side login-attempt limit enforcem…9.8
• CVE-2021-37935An information disclosure vulnerability in the login page of…7.5
• CVE-2021-37936It was discovered that Kibana was not sanitizing document fi…5.4
• CVE-2021-37937An issue was found with how API keys are created with the Fl…8.8
• CVE-2021-37938It was discovered that on Windows operating systems specific…4.3
• CVE-2021-37939It was discovered that Kibana’s JIRA connector & IBM Resilie…2.7