CVE-2021-39274

In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user to modify the main application and the application configuration file. This results in arbitrary code execution with root privileges.

• CWE-276

• https://github.com/1N3/Sn1per/issues/357Exploit, Third Party Advisory
• https://github.com/1N3/Sn1per/releasesRelease Notes, Third Party Advisory
• https://github.com/nikip72/CVE-2021-39273-CVE-2021-39274Exploit, Third Party Advisory
• https://github.com/1N3/Sn1per/issues/357Exploit, Third Party Advisory
• https://github.com/1N3/Sn1per/releasesRelease Notes, Third Party Advisory
• https://github.com/nikip72/CVE-2021-39273-CVE-2021-39274Exploit, Third Party Advisory

Published

Aug 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39268Persistent cross-site scripting (XSS) in the web interface o…6.1
• CVE-2021-3927vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-39270In Ping Identity RSA SecurID Integration Kit before 3.2, use…7.5
• CVE-2021-39271OrbiTeam BSCW Classic before 7.4.3 allows authenticated remo…8.8
• CVE-2021-39272Fetchmail before 6.4.22 fails to enforce STARTTLS session en…5.9
• CVE-2021-39273In XeroSecurity Sn1per 9.0 (free version), insecure permissi…8.8
• CVE-2021-39275ap_escape_quotes() may write beyond the end of a buffer when…9.8
• CVE-2021-39278Certain MOXA devices allow reflected XSS via the Config Impo…6.1
• CVE-2021-39279Certain MOXA devices allow Authenticated Command Injection v…8.8
• CVE-2021-3928vim is vulnerable to Use of Uninitialized Variable7.8
• CVE-2021-39280Certain Korenix JetWave devices allow authenticated users to…8.8
• CVE-2021-39282Live555 through 1.08 has a memory leak in AC3AudioStreamPars…7.5