CVE-2021-40889

CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() function to write username in password.php file when a user successfully changed their password. The attacker can inject malicious PHP code into password.php and then use the login function to execute code.

• CWE-94

• https://github.com/boiteasite/cmsuno/issues/19Exploit, Issue Tracking, Third Party Advisory
• https://github.com/boiteasite/cmsuno/issues/19Exploit, Issue Tracking, Third Party Advisory

Published

Oct 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40882A Cross Site Scripting (XSS) vulnerability exists in Piwigo …6.1
• CVE-2021-40883A Remote Code Execution (RCE) vulnerability exists in emlog …9.8
• CVE-2021-40884Projectsend version r1295 is affected by sensitive informati…8.1
• CVE-2021-40886Projectsend version r1295 is affected by a directory travers…6.5
• CVE-2021-40887Projectsend version r1295 is affected by a directory travers…9.8
• CVE-2021-40888Projectsend version r1295 is affected by Cross Site Scriptin…5.4
• CVE-2021-4089snipe-it is vulnerable to Improper Access Control4.3
• CVE-2021-40892A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40893A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40894A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40895A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40896A Regular Expression Denial of Service (ReDOS) vulnerability…7.5